Initial commit
Setup function to validate options
Validating and escaping untrusted data
Preparing custom SQL queries

This may not have been strictly necessary, since it's reasonable to assume that $wpdb->posts, $event_ids, etc are safe, but it's better to err on the side of caution.

It also helps to avoid human-error in the future, if an inexperienced programmer were to modify the statement. Because it's now already setup to prepare() data, it's much more likely that they would prepare() their new variable, whereas it's likely they would otherwise fail to realize that the statement now is unsafe and needs to be prepare()'d.
Changing site_id's type specifier from string to int

The schema for the blogs table defines the site_id column as a BIGINT, so we should treat it that way when prepare()'ing
Escaping output
Indenting bodies of if... blocks
Preparing custom SQL query

It's not strictly necessary, but a good idea. See earlier commit for full rationale.
Fixing table names in prepare() statements

You can't use printf-style substitution for the table name; it needs to be inline in order to work.
Changing site_id type specifier to int

See previous commit for full rationale.
Correcting indentation
Escaping output

It isn't strictly necessary in this case, but is a good idea. See earlier commit for full rationale.
Wrapping instances of %s in quotes

Without the quotes a syntax error could occur when the query is ran.
No longer passing two SQL statements through prepare()

They were added in a previous commit even though the data was safe, as a best-practice to future proof the statement. The event_ids variable can't be treated as a string, though, so it needs to be included inline. Calling prepare() with no parameters triggers a doing_it_wrong() notice, so it's ok to leave it unprepared.
Added nonces to forms on dashboard tabs
Adding missing echo for transaction results

The 'return' argument for print_r() was switch to true in an earlier commit, but I forgot to then echo the results.
Adding nonce value to Network Log search link in e-mail notification

A nonce was added to the search form on the Network Log, so the value also needs to be supplied in this link in order for it to work.
Making Domain column value compatible with sub-domain and sub-directory setups

The previous method assumed the WPMS installation was using a sub-domain architecture, and would only display the domain. This approach will display the domain, and also display the path if it exists. The result is unchanged for sub-domain installs, but includes the path for sub-directory installs.
Displaying note instead of transaction lookup if no credentials found
Updating TODO