If you look at the HTML form on the subscription donation page you'll see that the PayPal return URL is ubbthreads.php?ubb=paypal_ipn
<input type="hidden" name="notify_url" value="{$config.FULL_URL}/ubbthreads.php?ubb=paypal_ipn" />
On the reoccurring subscription it has three URLs (sub_thanks.inc.php, sub_cancel.inc.php, paypal_ipn.inc.php):
<input type="hidden" name="return" value="{$config.FULL_URL}/ubbthreads.php?ubb=sub_thanks" />
<input type="hidden" name="cancel" value="{$config.FULL_URL}/ubbthreads.php?ubb=sub_cancel" />
<input type="hidden" name="notify_url" value="{$config.FULL_URL}/ubbthreads.php?ubb=paypal_ipn" />
The paypal_ipn.inc.php script which receives the return status from PayPal, and all of the supplied order details, and updates the database.
IIRC the thanks script simply publishes a notation thanking the user for their order.