Hi Jack,
From our email messages I see you have enabled IPN already, that's good, but can you check and let me know if php deirective allow_url_fopen is enabled?
This is used to connect to paypal and verify the transactions, so there are no spoofed ones.