ssoo1,
Don't accept paypal, your asking for trouble. And when asking for credit card details, ask for the 3 digit number printed near to where the signature is. Also, only deliver to the address of the registered cardholder, although you may want to be more flexible with regular customers. If you are not confident in your own credit card handling system to do appropriate checks, then use a trusted 3rd party site to collect such details and then pass the money on to yourselves. But it looks like these people have got your site on there list of mugs. A professional image for your site that lets these people know that you will take action against them is also key.