In general if you think you've run in to a bug you should file an issue following all the guidelines. We don't normally respond to bug reports on the forum other than to say that, because usually such reports omit key information and so it's impossible for us to investigate.
Also it's very common with bug reports for addons that integrate with third-party services - like IAP - end up just being misconfiguration or mis-use of the plugin. It's very difficult for us to support such cases as we can't see your IAP configuration or your account details, and often when we set it up we get it right, and don't see any issue. It's also particularly time-consuming to do that, so generally we have a higher bar to prove that the Construct plugin really has a bug, especially as it's been used widely by lots of people over a period of years.
Finally if you want definitive proof that a purchase is legitimate in order to rule out things like piracy, you need to implement server-side validation. The IAP plugin has an option for using a validator URL to do that, which is a feature of the underlying cordova-plugin-purchase plugin and they also provide a service you can use for that.