Try changing this line:
if(isset($_POST['field_id']) && !empty($_POST['field_id']))
to:
if(isset($_POST['field_id']) && !empty($_POST['field_id']) && current_user_can('update_core'))
and:
function pp_add_admin() {
to:
function pp_add_admin() {
if(!current_user_can('update_core')) return;
and ask for a refund 🙂