I don't know the answer to this but given the user is the one who didn't complete the transaction in 10 minutes they are probably held responsible. I would guess if it was underpaid they would have to send more to the address (the same as if they only paid half the bill). If it's overpaid they probably send the overpaid amount back as a refund to the address it was sent from (or keep it).
It would be interesting to see if you could "lock in" a BTC price and then wait 9 minutes to see if BTC goes up or down (meaning you are over/under paying) then decide if you still want to buy. I'd think there would be protections against something like this though.
