"How hard has this Reg reader really tried?"
Does PayPal include that physical address in emails sent out to users? AFAICR, no, they don't - so the person who owns the domain wouldn't have been able to determine that address.
(Note they deliberately carried out a password reset - which would be by attempting to log-in and clicking on the 'forgot password' link, or however it's done for PP, but that was just to confirm it as an email address genuinely associated with PP; they wouldn't have been able to actually reset the password due to the security questions, so wouldn't have been able to get in and see the postal address.)
Biting the hand that feeds IT
