Seeing how he and the guy he hacked are both on gmail, I would guess that this might be a case of "mjfoo is the same as m.j.foo", or a gmail account that had been deleted before, but is still associated with a Paypal account. Paypal exist because of fraud detection and working security. If they had singe stupid bug like unescaped wildcards or something, that would be quite a shadow cast on their one main selling point.