They shouldn't be able to override a pingback URL if you're using encrypted URLs. The issue I'm finding is that many shopping carts and libraries aren't using encrypted URLs. :/