Maybe

But I have addressed the issue with your concern and posted a fix. Timestamp is now used to pad the initial hash so you would have to know the exact second the site scripts picked up the final transaction and corresponding address for that second.
I thank you kindly for your help!
But now your algo is not provably fair as no one can verify the timestamp informed by you.
Fair enough. How about we take the transaction id of the final payment and use that to pad the initial hash instead? This could not be known by anyone until it was too late, negating the ability of the last person to generate a winning address.
Does the dude abide?