It's No Big Deal until someone orders $10,000 worth of merchandise, pays $1 for it, and it gets shipped to an empty house in a subdivision before someone notices.
Then it's a Really Big Fucking Deal Oh God How Will We Pay Rent.
Then it's a Really Big Fucking Deal Oh God How Will We Pay Rent.
One thing I noticed that the OP did not mention was whether or not the website's own 'transaction ID' was part of the transaction details being sent and / or whether or not the third party site returns a transaction ID themselves. At least with Paypal, the client makes the payment then they are returned to the original site with a 'receipt' transaction ID and it is then up to the original site to take that receipt number and do their own look up, back to Paypal, to ensure that the amount paid was actually the amount it wanted to be paid...
If that is happening with the OP's site, then I don't think there's anything stupid going on (or, at least, it's relatively simple to resolve).