I have the contact details for the seller, so I could get in touch them myself. According to Paypal this is what their first step will be, though apparently this can take a whopping 30 days to resolve! I'm not sure if my interfering could invalidate the claim somehow?
It seems weird that I should be to blame on the password. I had a very strong one that is only used for this one account was never caught out according to
https://haveibeenpwned.com/ But alas, big companies tend to be bastards like this. $400 is a lot of money for me, so it would be a hard pill to swallow.
It appears that the money hasn't left my bank account (it's a debit card connected to my paypal by the way) or at least it isn't visible on my online statement yet. There are also no pending transfers listed, so perhaps I managed to cancel it just in time. I did literally spot within half an hour of it happening. Going through my inbox I also found a receipt of payment email which reads as follows -
"Your eCheque bank payment of $443.61 USD to TOMTOP TECHNOLOGY LIMITED (wholesale@tomtop.com) is in progress.
eCheques usually take 5-7 working days to process (estimated:28/04/2017 - 03/05/2017)."
This seems like good news? I guess I should probably contact my bank as well. A bit of a pain though, as I'm abroad at the minute.