It looks safe from theft. One flaw is that by using send(), people who deposited ether from a wallet contract that does too much work in the fallback function will lose their ether.

You can fix this by using call.value() instead. Check whether it returns false, and throw if it does. This would make you vulnerable to a recursive call attack except you're doing the ether transfer last, so you're still safe.

To answer the question in the blog comments, both send() and call.value() just return false upon failure, instead of rethrowing exceptions (which is what calls to other contracts normally do). Solidity devs left it up to programmers to decide whether to rethrow, because in some situations it's a bad idea. (Best to avoid those situations.)

If you were sending ether to anyone besides msg.sender, an attacker could force send() to fail, and thus deny someone their ether since you're not currently checking the return value. This is done by filling the call stack before calling your contract. But in this case the attacker can only hurt himself this way.

More details here.