I don't assume anything
I believe PGMusic would have by design any orders going through a seperate secure server.
A secure server will be much harder to infiltrate than a basic webpage server.. although accidental infection is surely possible from admin access.
Since the forum seemed to stay safe during the issue, I believe they have the different components on seperate servers or server partitions. I don't know of any trojan that can jump partitions or domains on a server. Otherwise I would be battling about 15 infected sites right now. One of the infected sites I listed above is still infected after two months (recurring issue) and is on a server that also contains a website I administor. This is how I knew about it to begin with; the guy called us to make sure we knew about his issue and to make sure it hadn't affected our sites, since all sites he administered on that server were getting infected.
I told him it was a sign that he was the one with crap on his shoes and everytime he went in to check his sites he was smearing a little around.
We know exactly what to look for and have seen no sign on our sites.

I do not work here, but the benefits are still awesome
Make your sound your own!