How do you verify that its actually the customer that has paid? Do you make them sign a message or what?
It doesn't matter who make the payment.
The address is generated to pay a specified merchant and amount. Once it is paid and confirmed, the merchant will ship and deliver the item.