Perhaps the cracker is actually employed at PayPal for real? :) This thought amuses me, since it's a scenario with no leaks outside the circle of PayPal employees, yet it gives the opportunity to the bad guy to gain the info necessary for the deed.