Bill,
The actual "from" field in the email is pretty meaningless, as that can contain anything the sender cares to put in it. What I'd be looking at is the route this mesaage took, compared to the systems that a genuine message from PayPal usually takes.
But even without that, it's got to be a scam anyway. There's no way that even your own bank should ever need to ask for your ATM code, nevermind anyone else.
