So, you are claiming that the user tried to double spend his transaction to your address, his double spend attack failed,the original transaction was confirmed (meaning you receiving the coins) and that's why he ended up receiving no coins?
Shouldn't it only matter if the transaction to your service received the 3 confirmations, which are also only needed to avoid this kind of attack?
We are not blaming anyone, and we didn't said anything about double spend. Its just the information that we gathered: first was the transaction FROM deposit address, and a little later later we received output addresses and balance to mix, but did not receive BTC, but usually it happens at the same time.