As an avast user, not an avast employee.
Surely the point of PayPal payments is that when the transaction is made you get transferred to PayPal to logon and authorise/complete the transaction.
So I'm somewhat surprised how did they get your paypal details and your authorisation ?