This is a recipe for disaster. The only thing that lessens it is that few people donate through static addresses posted somewhere. If you could prove that you displayed the requested address to each and every user, then you have something. Otherwise it's scam city.