to be honest you should just request a return address from the depositor instead of reusing an old address, it would allow people to send coins from one wallet and receive with another plus you wouldn't have to do something as gross as determining the return address from the outputs.
It seems he's wanting to have the Ponzi run entirely on the blockchain, so the users don't have to make an account on the website.
But it's a mistake to take random code from github and use it without understanding it or checking that it works as intended.