Did not think PayPal would set me up with an autologin without my permission, so I thought it might be a phishing email even though it looked legit.
So logged into my account without using the email link, went to my accounty settings, Security, and found the email really was from PayPal... the autologin described had been set up without my permission. Actually there were two. Very bad. Removed them both.