This is NOT full package.

The following line in the said php file

if (tep_not_null(USE_REFERRAL_SYSTEM)) {

should be replace with the following

if (tep_not_null(USE_REFERRAL_SYSTEM) && (tep_count_customer_orders() == 0)) {

To ensure only the first order of a new customer is entitled to grant point to his/her referrer. Otherwise, a hacker might hard-code the email address of a referrer and cheat for point

on every single order the new customer made.

More...