My wife received an email. It said that she recently bought bitcoin via paypal. She has never had a paypal account and has never bought bitcoin. It's apparently a scam hoping she would put in a working password. It's our best thinking.  I tried to log into paypal with her email and a fake password.  It said the into was partially correct.  It seems they actually created a paypal account with her email address.  I have not been able verify this but I see no other way.