That was a very dumb move on the site administrator's part and, hopefully, won't happen again. Any Web developer with half a brain houses submitted credit card numbers in a secure directory. At the end of a business day, the numbers are retrieved through the use of a password system. Once you have entered in your card and the business takes it from the server, the process works much like any other business that accepts credit cards. Either the business itself or a company built to handle large volume numbers makes an electronic transaction with the bank, and funds are transferred from the card to an account.
Some businesses even have systems set up so that the transfer is done automatically.
No person ever sees the card number. In my case, we do it by hand, connecting directly to the bank that holds our account. The transaction is encrypted and immediate. The session last no longer than the time required to make the transaction. Once I get the validation number, the server kicks me off.