If you think you’ve received a suspicious email or have been directed to a fake website, forward it to firstname.lastname@example.org and we’ll investigate it for you. After you send us the email, delete it from your inbox. If you clicked on any links or downloaded any attachments within the suspicious email or website, log into your account and view your transactions. It’s also a good idea to change your password.
I am sorry to hear the variables are all blank with the Instant Payment Notification message feature. To get this taken care it would be best to file a ticket with the PayPal Merchant Technical Support team or you can visit the PayPal Developer Forum.