Consider what the finder could have sold the exploit for, and the damage it could have caused.

I think given that you could effectively steal from any account for which you knew the email was worth significantly more than 10k.

So what? The value of the vulnerability to PayPal does not change whether the finder is in Egypt or Norway. PayPal should pay based on its perceived value, and not the finders.