Membership & PayPal - major flaw?

I have a simple membership site. I have 1 paid level and 1 free level (the guest level) and checkout using PayPal (standard, to deploy a renewing subscription). During the signup process, it seems as though anybody can put in their registration information (username/email/password) and then actually CANCEL the payment part via PayPal's "cancel and return to Site" link at the bottom and still have COMPLETE access to the site. Totally defeats the purpose of paying for content. Please tell me I'm missing a step or configuration or something.