do exactly as has been said. Cancel the paypal account ASAP.
It's VERY easy to make an e-mail look like it came from where ever, and whenever you want it to. I could send you an e-mail right now that says it came from
service@paypal.com
If anyone, from any service, e-mails you requestion any information whatsoever, always contact the service directly before doing anything about it. I don't know of any service that actually has ever done that.
Hope everything works out before they do anything bad. Paypal isn't very good about protecting its users.