A scammer would be fairly easily distinguishable from someone making an honest mistake, the difference being that you've already made x* the turnover of the 'mistake' on the honest customer, and the scammer would actually be using those instances for something.

Scammers, as a rule don't go for solutions with a high up-front investment in their time, they'd be much better of using a few thousand stolen credit cards instead. Why bother asking for refunds on a real life ID when you can get away with someone else holding the bag...

Heroku should sidestep this question anyway and implement auto-scaling and notifications on certain thresholds asap.