Thief " premium points "

[Nuelman]

Hello Someone's stealing from my "premium points" server I don't really know how he's doing it... Whether anyone can give me an idea of where I might be at fault.
Tfs 1.x
My server 10.99
Web- xxamp
Ps: Can I publish the website to see if you can find the bug?

I am ussing paypal I think that error is here:

$file = 'paypal.log'; //Paypal Log Name will be placed in the same location as your ipn.php file
$payer_email = $_REQUEST['payer_email'];
$ip = $_SERVER['REMOTE_ADDR'];
if($ip != "66.211.170.66" && $ip != "216.113.188.202" && $ip != "216.113.188.203" && $ip != "216.113.188.202" && $ip != "173.0.81.1" && $ip != "notify.paypal.com" && $ip != "73.0.81.33" && $ip != "173.0.81.33" ) {
    print "Acess restricted";
$hak = fopen("scammer.log", "a");
fwrite($hak, "$ip \r\n");
fclose($hak);
die(0);
}
$time = date("F j, Y, g:i a");
// REMEBER THERE ARE DOTS AND TWO ZEROS
$paylist = array("0.01" => 500, "10.20" => 1000, "20.70" => 2000, "40.80" => 3000);

some idea?

Thanks