Gee, according to these three paypal emails I just got, I bought somebody three dell laptops at $700 each. From an account with an email I don't use for paypal. And the mails never went thru any server with paypal in the name. I suppose I'd better click this here 'cancel transaction' link and sign in with my paypal name and password if I don't want to be out $2100, hur hur.
edit: four. I do have to admit tho, that I do like it when they hide their IP address by representing it as a single four-byte integer. I wonder what TCP stacks that /doesn't/ work with.