I had an order come in that wasn't followed by a PayPal payment, so I asked the customer if he had paid, and he sent me a screenshot of the receipt which shows the payment going to "Trust Website Payment", which of course is not me.
I did some digging around and noticed copies of order emails were going to "firstname.lastname@example.org", and payments were to be sent to "[myshopname]@yandex.com" (instead of @gmail.com).
I fixed all incorrect information, changed all my passwords, and updated to the latest version of Magento (I was at least one update behind). Next order came in without issue (except that I had to "authorize" the PayPal payment, which I've never had to do before), and then the order after that came in... once again no PayPal payment. This time the customer's receipt says payment went to "[a_variation_of_my_website_name] Payment", which is not, of course, me.
I did more digging and noticed a "PayPal Express Checkout" option added at the bottom of the Payment Solutions section that has the "Configure" option grayed out (see attached image). I suspect this is the culprit and last remnants of the security breach - but how do I remove it? Should I just do a total reinstall?
Thanks in advance