Hmm,
I'm sure Paypal once had an email address, but they do like all fraud to be reported by telephone now so they can get it logged and suspend the Paypal account in question.
I have rang them a few times and they instantly freeze the account and email the user to call them ASAP.
Regards...
I would definitely recommend installing Mod_security with some decent rules if your going to host wordpress with a load of plugins. We have been using the atomicorp rules for years.
Have a look at -
https://www.atomicorp.com/products/modsecurity.html
Regards,
Ashton