So admittedly I've only ever dealt with Paypal as a third party taking payment (as opposed to a few other systems where my server talked directly to the payment

So admittedly I've only ever dealt with Paypal as a third party taking payment (as opposed to a few other systems where my server talked directly to the payment gateway). One thing I noticed that the OP did not mention was whether or not the website's own 'transaction ID' was part of the transaction details being sent and / or whether or not the third party site returns a transaction ID themselves. At least with Paypal, the client makes the payment then they are returned to the original site with a 'receipt' transaction ID and it is then up to the original site to take that receipt number and do their own look up, back to Paypal, to ensure that the amount paid was actually the amount it wanted to be paid... If that is happening with the OP's site, then I don't think there's anything stupid going on (or, at least, it's relatively simple to resolve).