I had this happen with my ebay account, which is a smallish seller account that I haven't used in some time. They purchased something with my account, using the right password. The payee wanted payment and sent me a notice that I owed them money. I contacted Ebay immediately. They were wonderful and cleared it all up in no time. BUT - I now keep separate passwords for ebay and paypal just to be sure. I also NEVER respond to any e:mails asking for info, just delete them.
I didn't know about the security card thing though. I'm going to find out about that! Thanks for telling us.
Glad you got it straightened out. If ever in doubt, don't hesitate to log in and ask them to check into it. They're really good about that sort of thing - they know they're always under attack.