What if an attacker rewrote the recorded bitcoins addresses(SQLi) to have sent money routed to their BTC address instead? unless everything was strictly email then that might be different.
They aren't using the website to send anything but alert the store which address payment was made from so no diversion is possible, no BTC passes through the site.
For an attacker to divert funds they would need to modify the stores listed address. Payment address can be firstbits vanity address as domain name for the store.
store owner should periodically download a dump of the address list to make sure all of them are legit, and keep as few online as possible.
eg. start with a list of just 20 addresses, and every time the list gets down to 10, send an email to admin saying 'top up the address list'. that way, a tampering of the list will be easier to spot.
you might also do some kind of merkle magic on the list to make tampering even quicker to spot.