Wait. What? I haven't bought anything through PayPal recently.
Like you, I get a lot of bogus emails, but I do take the time to send them to the authorities because I really hate those miserable bastards. So I check PayPal's site to find where to send fraudulent emails, and I forward it along. The site thanks me for my activism, and advises me to check my account, which I do, and the transactions are listed as "completed."
"Completed"? Wait...what the hell? I didn't click the the "Transmit Payment" button...
HOLY SHIAT!! DEFCON 1!! BATTLE STATIONS, BATTLE STATIONS! THIS IS NOT A DRILL!!! REPEAT — THIS IS NOT A DRILL!!
So I call PayPal immediately. Apparently someone accessed my account, and PayPal admits they don't know how. I dutifully used a password with combinations of upper & lower case with numbers, so...well, I don't know how they did it either. But PayPal assured me that I caught it so quickly that no money was actually transferred.
Good thing I got up early on a Saturday.