In the fourth paragraph that starts "Twenty minutes later..." he specifically states that his account email and password were changed on his account a second time. This is after calling in to paypal to fix the first hack.