This is what likely triggered it. People that steal PayPal credentials change the shipping address to something other than the address on the PayPal account.