Is transaction malleability an issue when receiving payments? Assume I'm using the original client to receive payments. Is the following scenario possible?

My wallet gets notified of unconfirmed transaction with id 12 in which one of the outputs is an address that belongs to me.

Someone changes the id of the transaction to 13 and relays it to the miner who finds the next block.

My wallet gets notified of block that contains transaction with id 13 in which one of the outputs is an address that belongs to me.

Transaction with id 13 gets 6 confirmations but transaction with 12 gets stuck in my wallet as an unconfirmed transaction.

If I'm showing my customers their unconfirmed transactions, then the customer will see a confirmed transaction with id 13 and an unconfirmed transaction with id 12. Is that correct? Or will QT automatically delete the first transaction?

What can I do to prevent this?
If you wait for a confirmed transaction you will be fine. The common mistake people/large exchanges make is when they constructed "withdraw" transactions from unconfirmed "deposit" transactions. Those invalidate quickly due to double spend rules. The Satoshi client does this as a last resort when picking unspent outputs. 

The code that deals with it is here, removeConflicts is defined here.