Good news is that Paypal have refunded the transaction and sent me details of how to disable the mobile application facility on my account (But I imagine a hacker could switch it back on).

John, my email address is not private, but only used for incoming mail, therefore a keylogger could not have intercepted outgoing mail for passwords. Nor will it ever have been in my Hotmail account.

I have never, ever, typed my paypal password on my phone or on that email address. So I still believe the security breach was not down to my actions. But I don't suppose I will ever find out.