PG is absolutely right re: treating publishers as servers: this is NOT just about fraud, please take a look at this: http://news.ycombinator.com/item?id=3803981
Requires a separate login to that to vote or reply.
At first I thought you were potentially man in the middle.
While the whois says the domain is owned by "Paul Graham" at the appropriate address I don't separately even know if this information is correct as anyone can put anything in whois owner info.
My recommendation for developers who might have this issue on their own site is to set up a redirection script at all the non-canonical names. The redirection script should redirect to the canonical name and include the full path and query string if they exist.
I also take that opportunity to log the traffic so I can report on which names are generating traffic. That can help when you are deciding wether to allow names to lapse.