I doubt paypal was hacked, but something worth checking into is the security of the shopping cart script you have linking to paypal. A lot of people don't realize that this is a huge point of vulnerability as far as having people hack back...
Make sure it's airtight