It was a very straightforward and easy upgrade so his admin files are all new -- I even uploaded the orders.php again to make sure. The order emails are including the attributes but they are missing from the orders themselves.

The upgrade was from an unpatched and hacked 1.3.8 store. I found about 20 php files in images and there were quite a few entries in the record companies database table with php file references. The site owner never saw any evidence of the hacking. Someone looking into his image folder saw the php files.

Any ideas?