That maybe because at the buy.php of the Glacier CP, it fetches the username and password of the account. Here's what they've done to do that:
Steps to Replicate the Scenario:
1. Login to the website
2. Open New window, go to the website, go to the desired item you wanna buy
3. Open change pass on the 2nd window, proceed changing password.
4. Press the Buy button on the first window.
Steps to Solve the problem:
1. Remove the ...WHERE UserPass=... line on buy.php.