[bcrescimanno]

Former PayPal employee here.

In truth, you got the best possible experience and it's good that you reported it. Ultimately, what would happen internally is that we'd detect this malicious use and cancel the invoices so it's not possible for the scammer to continue to collect on them--but we couldn't "claw back" the emails that had already gone out. The email looked legit because it was an email from PayPal about a real invoice.

I don't know if they should be more proactive in their communication with folks in this situation and it's been over a year since I left; but, this is not a new issue at all and it's something we would contend with from time to time while I was there.