How to prevent an order for $643 million?

290000 x product name here = $6,536,600.00
size small
colour black

Sub-Total: $643,377,586.00
Zone Rates (The shipping rate cannot be determined at this time): $0.00
Total: $643,377,586.00

Here is an order we got today. Clearly a hack/scam. We accept payment by bitcoin (with the Spectrocoin plugin) so this is the option used by the scammer.

The question is how do we prevent such large orders being accepted? Especially a QTY of 290,000 etc?

On further checking it is also possible to view your cart and change the QTY from 1 to 6000000 etc and refresh for an order of a billion dollars. How to control the maximum QTY allowed to say 5 ?

(using 1.5.6a on Linux)

Create the PHP file /includes/modules/pages/shopping_cart/disallow_cart_total_over.php containing:

<?php
// -----
// If the cart is over a specified value, empty the cart (and the customer's basket) and return to the shopping_cart page.
// Change the 2000 value (it's a number, so no commas) to whatever you're comfortable with.
//
if ($_SESSION['cart']->show_total() > 2000) {
    $_SESSION['cart']->reset(true);
    zen_redirect(zen_href_link(FILENAME_SHOPPING_CART));
}

No sir, this is not scam. I am manager of the Walamart, sir, and we want to buy your product so we can distribute it in our stores. But sir, just to verify you're a legit business, we need you to send us a $100 gift card, sir. This is only for verification, sir, so we can continue with our order, sir.

Sorry, I just had to...
Anyway, this Spectrocoin plugin - I'm not sure how it works... Does it first create the order and then ask for payment or is it completely manual, as in creates the order and gives the customer a link or your wallet address? If the latter, it's basically like money order, right? And you just have to wait for the funds to show up? If it's an instant payment module, the order would get created only AFTER the payment has been made. Actually, this kinda answers my question - if this was the case, I don't think you'd be complaining much with $650 mil in your bitcoin wallet... Perhaps look into some instant payment modules...

Is your products' stock really unlimited? Why is it possible to add 290k of the same product to cart? If your stock is limited, enable it from admin->Configuration->Stock and don't allow checkout with more than what's in stock.

Although lat9's solution should work, I feel like it's taking a hammer to whack the fly on your window... It's OK for a larger amount, ie 20k which probably is a scam, but a 15k scam is gonna go through. And if you set the bar too low and it's a legit order over that amount, imagine the customer's frustration when the cart is simply emptied without explanation.
A similar solution, but on checkout_shipping would IMHO be much better - check the total and if it's above the threshold, redirect to shopping_cart with a custom message (in messagestack)...