My thoughts on the refund are :

I personally think that the refund is up to aLx since you should've checked out that the site wasn't vulnerable or exploitable...

He sold what was shown and I'm sure he never said that it was 100% secure.

It really came down to morals.