I just read this over at the eBay community forums:
eBay third-party authorizations and/or some glitch with Pitney Bowes (they are the contractor eBay / PayPal uses for postal labels) combined with PayPal pre-payment authorizations appears to be how the scammers are doing it. No need for your password - even PayPal's security key (if have one) won't protect you from this type of thing.
However, there is something you can do to better protect yourself:
After your PayPal account is unlocked (whenever that occurs), log in and do the following:
1. Click on Profile >> My Money >> Preapproved Payments
2. Disable "ebay shipping" pre-payment authorization.
From there on, you will be asked for your PayPal password whenever using eBay Shipping. Be careful not to re-enable the pre-payment authorization - eBay may ask - be sure to always decline.
In the meantime, right now, log into eBay, click on Selling, click on Shipping labels and void out the two bogus labels.
They may already be voided, if you already contacted eBay in addition to PayPal. But double-check. This won't stop the scammers from using them, but will make it easier to dispute the charges with PayPal.
Hope this helps.
It basically reiterates what I said about preventing this from happening, and sheds some light on how it happened. Apparently it's due to a software glitch that has nothing to do with your password so unfortunately everyone is vulnerable to this. If you take the steps listed above though you should be safe.
I've also read that Pitney Bowes is apparently being held accountable for the reimbursements eBay has to make.
