Concurrent Refund Requests Can Exceed Payment Amount (Financial Loss)

Describe the bug

A critical race condition vulnerability allows concurrent refund requests to refund more money than the original payment amount, resulting in direct financial loss to event organizers.

When two refund requests are processed simultaneously for the same payment, both can pass validation and create refunds that together exceed the payment amount.