When PayPal first told me there was a problem I wrote to both the bricklink account and the email from the PayPal payment. Neither responded. No one is going to go to the effort to hack an account to send something to the person who paid for it. Its the chargeback fee that gets my goat.
I’m guessing this person knew that there was a vulnerability in PayPal and exploited it to their advantage. Anyway, this was nothing compared to the impression left by a deer on the front end of my car this morning.