We figured that this is the issue, and for those two transactions to have the same weird 1 Satoshi in them might be all circumstantial and there could be nothing more into it. We hope at least... Our system has been ignoring those transaction with invalid hashes and processing the valid ones accordingly.
Our system has exactly the same problem, 1 satoshi spam automatically causing double spending attempts for larger deposits. Can't quite figure out what's there to play with, but it sure doesn't smell good.