I often wonder how this actually happens. I think it has to do with security at times and who has access to your computer. We all have a file or a secret piece of paper containing passwords and logins. Who can remember all of them?
I'd start with a good spyware/malware/virus scan in safe mode using several different programs. I like Microsoft Security essentials, Malwarebytes, and Spybot for that. All are free for scanning, but Malwarebytes offers a $24.95 lifetime license that also enables real time monitoring in resident mode. It's worth it. I get blocks by Malwarebytes occasionally when I click on a link that turns out to be on the rogue site list. It's easy for a little rogue program to sit in the background and sift
through your hard drive looking for logins, passwords, account numbers, and credit card numbers. All these get phoned home to be persued by people who want access to your money.
After that, I'd have a long talk with Paypal and your credit card company about how they think this happened. It may require talking to a supervisor.
I'd definitely ask for a reissue on my credit card with a
new number.