But they have no way to verify the ID is actually him as it was not required to create the account

> What else do you want them to do? There's a bagillion compromised PayPal accounts actively scamming people

... actually check using humans and not "algorithm told me it's a fraud, therefore it's a fraud" ?

I had dumbassery like that trigger (not on pp) just because I didn't use account for few months then used it once...