Hi John,
I'm going to send you the code, but as a reference only. You should make sure you look at the code and figure out what you need to customize in order for it to attend to your particular needs. Don't use it out of the box.
Some key things to keep in mind:
1 - You need to send to paypal the userid of who is buying. This is send via the "custom" field in the paypal API - This information will always be sent back to you on any communication from paypal, including payments and cancellations. This is what you will use to identify which user is the communication from paypal referring to;
2 - Because on #1 above, you need to make sure that only logged in users will be able to buy, otherwise you will not know from whom the payment/cancellation is coming from;
3 - You need to have an IPN page (I have called it ipn.aspx) - This will be the page that paypal will post the messages to it so you are able to capture what is coming from paypal;
All these 3 points are handled in the code I will send to you. Again, use it as a reference. Don't just use it blindly out of the box.
Cheers,
Aderson