Given the below payment model, how do I prevent my main wallet from being drained on my e-commerce store?

Question

Via the wallet-rpc api

1. An integrated address is generated for a one-time payment
2. User pays to address
3. User is refunded excess payments

It is currently implemented like so:

1. A walletRPC wrapper object is serialized and put into the users session, representing an interface to the walletRPC object and the information about the payment (ie: integrated address, payment ID, amount to be paid)

2. The payment details are stored in an sql database

3. If the user logs out, the payment object is restored from a payment entry in the payments table

4. When the user pays, the script calls the get_payments RPC method every time the user checks the payment status

5. Once get_payments returns enough $XMR, the order is sent through to the seller

6. Once the payment is made, a refund is made to the users refund wallet, specified once the order is placed.

In the last point is my problem, I realised the only protection against infinitely draining the wallet through withdrawals was using my own PHP code. It bothers me because I don't want to mess up, I would rather there be a hard-limit on the amount withdrawable funds.

What is the best way to go about this? Just delete the payment once the refund has been made? Or is there another thing I am missing?

TL;DR:

I want a good refunding process that makes it impossible for the user to refund indefinately.