This wasn't paypal's fault. I mean entirely.
The problem was with goDaddy. The last 4 digits of credit cards show's up everywhere. Check your receipts. Related question in stackexchange: http://security.stackexchange.com/questions/37758/safety-of-...
GoDaddy should not use the 4 last digits as a way to confirm identity, exactly for the reason I mentioned above