"E-bay CS support tells me that it probably started with them 'hacking' my e-mail account...."
That is not likely. The way people hack PayPal and eBay accounts is usually much different.
It starts when you receive an official-looking email that says it is from: security@ebay.com or from:security@paypal.com or something like that. The email has official-looking legalese and copyright notices on it, and it says something to the effect of "Because of a security problem, we need to validate your user information. Please click on this link and answer the security questions."
When you click on the link, you go to an official-looking Web site that has the eBay graphics and copyright notices and looks 100% identical to the eBay login screen, and asks you for your account name and password.
The instant you type them in, you're doomed. The email is fake; the site is fake; when you enter your username and password, it gets emailed to the hacker.
eBay and PayPal could easily take protective action that would help prevent this scam, but they don't want to.
Why?
Because they make money from the scam. A LOT of money. Millions of dollars, in fact.
Here is how eBay and PayPal profit from the scam:
Suppose you are a buyer. Your account gets hijacked, and used to buy goods online. The seller receives the money, and sends the goods. Then you complain: "I did not make this purchase!" eBay takes the money back from the seller (**WITHOUT** notifying the seller in advance!), and also takes a "chargeback fee". eBay gives you your money back, but keeps its fees.
The police are usually unwilling to investigate this kind of fraud; it's considered a very low priority forthem. Often, they won't even bother to file a complaint.
This happened to a friend of mine; a fraudulent transaction was made using a hacked account to buy hundreds of dollars' worth of goods from him. The real owner complained, the money was yanked out of my friend's bank acocunt without notification, and eBay refused to answer questions about why.
The police refused to take action. My friend actually had to track down the criminal, using the shipping address the goods were delivered to (which was the criminal's aunt's house), and supply the police with the criminal's address and proof that the criminal had hacked an eay account before they would take action.
The criminal got six months' probation. My friend never got his money back. eBay made a profit.
