It's not just PayPal fraud per se. Leaking user's PayPal email address and password has a lot of other consequences. (Yeah yeah in theory you should use distinct passwords for different sites etc etc)
(Yes, that's pretty nasty - but is putting a poorly-secured "startup" online really any better?)