I guess we'll never know, but last 4 digits are not difficult to get (they're on every single one of my receipts... and for all we know, this guy could be in close vicinity of him...), and making up that PayPal gave the hacker those 4 digits is a good diversion.