A completed order without payment was saved to the site owner's database that contained XSS exploit code entered into the customer name, customer address and order comments fields. The XSS exploit code attempts to load a 3rd party JavaScript by inserting a HTML "script" tag into the form fields and then trying to access session credentials when the site owner logs-in to the administration system to view the order details. The exploit appears to be originating either from Turkey or China, which I've determined based on the domain name that the JavaScript file is served from (which may be linked to a Turkish exploit group) and the language settings in the exploit control panel (Chinese). Another indicator that this customer was bogus was that the telephone number given is invalid for the UK, although the address provided was a valid UK address.