A somewhat bullet proof way is to keep track of what they ordered and be able to total it up. The total you can then compare against the PayPal IPN transaction. If the paid total and the calculated total don't match up, then there was a problem. Trick is, you'll have to keep track of the order itself, which items where ordered, and what the order total was (including things like shipping and tax if need be). In a case like this where a thug snags the code and tries to tweak the values and run it on another web server, its do-able. But if you're checking if the order exists, and the order amount matches the paid amount, then you will know if the transaction was good/valid and can send the goods out (otherwise, you've got a bad order and some money for it).
