If PayPal allows someone to access your account information without proving they are you, then it is absolutely PayPal's fault. Knowing your name, address, DoB, SSN, is not proof that the person knowing this is you. If they (or any business) assumes someone who knows this information, and claims to be you, is you, then ultimately it should be their loss due to their lax security ... not yours since you have no control over how lax their security is.
Information like name, address, DoB, and SSN is about identifying you (and locating you in the case of an address). But these (including SSN) are also public information (while SSN is not widely known, it is still technically "public" based on what its purpose is).
I don't know that it would be worth it for you, but part of me wants to see you sue them. If it happened to me, I would. It's for cases like this I wish I was an attorney and could afford to represent you for free. One of my big interests in all this is about ID theft (and the terribly poor security most businesses practice that leads to ID theft being so widespread). And if what you have said here is true, it is definitely a case of ID theft.
I'd also like to see a class action suit against some irresponsible company like PayPal just to better establish their liability for failing to verify who is using or accessing their services, when such activities have serious negative consequences for others.
Her story about "within 12 months" is entirely bogus. Being a victim of ID theft is PERMANENT, unless and until you can get all that info changed. Unfortunately, SSA doesn't easily let people get a new SSN (if they did for ID theft alone, they would have run out of numbers by now).
What I can suggest is you add your voice to the already large chorus of people who have been ripped off by this company. Organize your story as clear and thorough as you can, and let it be known. Maybe it will at least prevent someone else from being ripped off.