What he's been doing is making bogus transactions through Amazon. Due to the kind of stuffty way amazon handles payments, these come through as "initiated" to my server. I give people the benefit of the doubt and give them their key immediately because I don't want paying customers to have to wait. The master server receives an updated status from amazon a little while later indicating if the payment completed or failed and will deactivate the key if necessary.
Unfortunately this just won't fly anymore, so I no longer give people the benefit of the doubt. Only completed transactions are acknowledged. This will only effect a very small percentage of legit customers.
Note that as soon as I patched this, okiver threw a tantrum and ddos'd the server which is why it was down for a minute or two.