I was hacked a few years ago - PayPal called me, just like the bank sometimes does, and asked whether I had authorized payment to an offshore gambling place. I hadn't. In discussing it with their rep, I learned that I was at increased risk by using the same password as my email account. My email was hacked at an airport using free wi-fi, and the hackers tested PayPal accounts with hacked email addresses and passwords to see if they had a way in.

The lesson: although you use an email address for your PayPal login, you should pick a different password so hacking one doesn't compromise the other.