The way that they probably got your paypal info is through your email. Since paypal uses your email address to log in, all they have to do is click on forgot password, and as long as they know your bank account number or credit card number, they're in.