nice catch!
Still, I will assign a temporary BTC address based on session. Each visitor opens a new session which can be saved to the database. Each deposit request will call a script that creates a new wallet on Coinbase, which will be saved on the database with it's session identifier (and/or user id) and expiration time.
Another script will run every x minutes (probably a cronjob) and requests wallets balance. If user sent some BTC to the wallet, the script adds the difference to users balance.
Thats my point of view. I'll post an update if it works out or not.