Is transaction malleability an issue when receiving payments?
If you wait for a confirmed transaction you will be fine. The common mistake people/large exchanges make is when they constructed "withdraw" transactions from unconfirmed "deposit" transactions. Those invalidate quickly due to double spend rules. The Satoshi client does this as a last resort when picking unspent outputs. 

The code that deals with it is here, removeConflicts is defined here.