Well, the site should be using SSL if they handle credit card info, but with enough computing power and free time, sure, why not? More likely, it starts with using an unsecure service like webmail. From there, they can reset your paypal password and find out your bank account number and so forth.