Not that scary, and more my fault. The e-mail they sent asking for payment was a link to Paypal. I'd already paid 50% up front, and the second link stated "remaining balance of $26k+" and never showed a confirmation page. Sure enough, the charge was for the full amount, so I've now overpaid 50%...