Only 1 Link to Single Post When Visitor Purchases Multiple

This is regarding the ability to sell multiple single posts. When the visitor purchases more than one post, they get an email with a link to one of them. But not both. Should there be two links in the email if they purchased 2 posts? Below is my shortcode…

[s2Member-PayPal-Button sp=“1” ids=“1500,1408” exp=“720” desc=“Purchase listing(s) for $1” cc=“USD” dg=“0” ns=“1” custom=“tjohns.greatfixer.com” ra=“1” image=“default” output=“button” /]

I have more info/concerns to accompany this…

I found an article that says that if someone purchases multiple posts that they will only get an email with a link to one… and that you have to have links to the other posts on that post. That basically, to me, says that this functionality is broken. If we have 200 posts for sale, are we supposed to have links to all 200 posts on every single post??? And make the customer dig through them trying to figure out what they bought? That’s not acceptable for anyone that wants to build this kind of functionality.

Another thing I noticed. I took the URL to one of the protected posts that was purchased. For example…
/property/941-w-133rd-st-compton-90222/?s2member_sp_access=fnIyOkJvMGFGR1k1NlhydXBPdmF4UHVHNmpkMXloS3E4cG91OjIyMjZjYmRiYjZmOGVmODE2MGI2YzAxYjRjYTNhMzUxfJIppICoGNCEf5Y1UaQ-AOo7wxwgg8a4Jk4QgqUmoVZxXp28YYNSt2pwDbwavYtuxI3PTm83ABuXUu0cFDnwk9g

And replaced the post alias (941-w-133rd-st-compton-90222) with the alias of another post that was NOT purchased. And it was accessible to the test user. So is this system not secure?