In the worst case scenario, an attacker can send in one nonsense customer order that gets deleted by staff when they see it. This happens about twice per year. Customer orders are not stored anywhere on the server.