So that basically means that if you're relying on listtransactions to track incoming transactions to a web app account you're in deep trouble...
No, only the amount sent to the address associated with the web app's account(s) will be reported in listtransactions.
But that's exactly why this is a lot harder than it seems-- we've got to think about weird transactions people might use to try to break websites that use this API.