Victimized! Really, just naive.
The second I received this confirmation in my inbox this morning I realized: Uh huh, I never bothered using a *good* password on PayPal.
In fact I apparently used the same one to comment on a Gawker Media story.
Please take this as a WAKE UP! If you may have ever signed up / commented on a Gawker Media site (Lifehacker, Gizmodo, Gawker, Jezebel, io9, Jalopnik, Kotaku, Deadspin, Fleshbot) read this post:
http://lifehacker.com/5712785/faq-compromised-commenting-accounts-on-gawker-mediaFor me: No biggie - I knew I had this coming some day and I've finally managed to kill off that password everywhere it existed. I'm certain this charge (and the one that immediately preceded it) will be voided.