I have only PPEC enabled on my site. One of my friend placed an order to test the website. He went through the 'Goto Checkout' and was able to go through Paypal and used his Paypal account to pay. Order was created successfully but payment did not come to our Paypal account. Order confirmation email states that Payment method used was 'Credit Card' which is not even enabled on my website. What can be done to prevent this from happening?

I have latest patch 'PPEC-137-patches-March21-2007' installed.