If it works right now it dosnt mean it did today when the hacker made the orders. If it worked then right then the thief is one of you or your server was hacked.