"It's possible they didn't grab email addresses from all accounts but instead grabbed some range we haven't determined yet."
Or, that they only *sent* emails to a given range for now, but more are to come.
Maybe a global notice should be posted (like you did with the logo survey) at the top of all our screens for a day or two, to warn iHubbers not to respond to any Paypal emails..