Change your password.
Watch your PayPal account for unusual activity for the next month or so.
Watch for unusual acitivity on the credit card (or cards) and bank accounts associated with your PayPal account.
Watch for anything out of the ordinary pertaining to any of those accounts or previous transactions on those accounts…
You have to assume the worst case – they had your email address and password for several hours or days, and that's all they need to log on to your PayPal account, send themselves money, change your password, see what credit card and checking account are linked, see any addresses you've stored, and review your recent transactions.
From that last they could pull more tricks. If they can spoof email fro PayPal they can spoof an email from that guy you bought something from on eBay last month, offering to sell you more of same or something related for an unbeatable price, or some other offer to draw you out and get more information.
WORSE, they could spoof an email to someone you've recently traded with pretending to be you, and try to scam them using your good name.
You need to be extremely thoughtful and vigilant for the next several weeks.
Andrew
