They used to say that if you were unsure if an email was from Paypal, you could forward it to spoof@paypal.com ...don't know if that still holds true, but you can try it.