Apparently some bot (or exploited people) network has been running fraudulent purchases through the Golgotha Graphics FastSpring store. The angle appears to be that because my books are relatively inexpensive, the purchase is small enough to not be noticed. If it’s successful, it marks a particular set of (stolen) credit card details as valid, so they can then be used for something larger.
The scale of it was pretty impressive, dozens of purchase attempts every minute, which I hadn’t known about because the system by default only notifies you when a payout is due, after a certain amount accrues.
I reported it to FastSpring, and it’s now in their hands; after all, they’re the ones with the big fraud detection network, etc.