He either fell for an email, or his computer isn't secured. If they got his ebay password first, then he shouldn't have had the same password for ebay and paypal.
My ebay was used somehow, but no real damage. Unfortunately ebay won't tell you how they found out it was wrongly accessed. I just logged in and ebay had disabled my account because there was a Rolex listed.
A few years ago I logged into my ebay account, but the "My ebay" page wasn't mine. I was looking at someone elses auctions. It would let me go into their auctions, all worked. Could modify or whatever I wanted to. So ebay isn't perfect, there is flaws. They do not give access to paypal from ebay for safety reasons in case ebay gets broken into, so passwords should be different for your safety.