maybe you guys should verify that that person is who it really is?
maybe make them email you with the paypal email that was used