Thanks for pointing out it's set to 6 confirms. We'd done this to match JD after you posed the security risk of 1 block transactions!
As for the script, I know both yourself and the Clam developers have both audited the code and made tweaks.
As for the original bugs, I believe that they have been patched and have faith in the new script.
You are 100% correct about the payouts looking for the 1st or 2nd transaction to send back. This is why we ask you not play from JD or exchanges.