Presumably order numbers are easily guessable, so the md5 really offers no protection at all in this case and is no better than just using the order number
And the thing is, even if they can't be guessed, it's only 999,999 calls to try every 6-digit possibility. And you'd only take 11 days if you were nice and paced yourself to 1 req/sec.
