Odd... can I see a copy of the confirm.php page? It looks like the information wasn't even sent to paypal, so that explains why it wouldn't be in your database. Somehow they are able to get through the server validation and not provide customer information. I'd have to look at the page to see how.