Yes, the email actually came from PayPal. You can't trust anything these days, as this new kind of phishing scam employs a clever twist.