I found a security flaw on the site that bypasses checkout.... its a js problem thats in the page src.