I was going to say the same thing. Remove your bank and credit/debit card details from PayPal until you get this sorted. Then contact PayPal to report the strange activity.

This is very strange indeed.

Recently I had an email from PayPal saying someone attempted to log into my account from a location I've never been to. They made me reset my password, and also confirm my identity with an additional form of id. I scanned my passport and used that.

This is also a reason I don't use gmail or any other webmail as a main account to register anything or do anything serious. I only use my own private email addresses and server for these.