Wait what? They track an individual's payments based purely on TransactionID?

It's not the first time I've heard of such an issue.
They do track the address. But once a payment is made, they no longer track new transactions and wait for the first transaction to be confirmed. If the first transaction is removed, they consider the payment as failed.
Look at the following thread. There was a same issue with changelly. (The OP's problem was solved after contacting their support off course.)
Please help with coins missing in transaction.