You can apply it on the confirm page based on the same trigger as the payment processing and it won't send unless the transaction is approved. The transaction processing code stops code from processing below it when it fails.
Persistent forms save the form in the session. However the email you are sending seems to refer to the form $_POST directly, which won't have any values.
The code you placed on the success page doesn't match the code I suggested you add to it.
I think it would probably work if you copied and pasted the code I suggested to the success page.