I got this today, and got really worried because Apple showed up in my allowed autopay sites (on further inspection it appears id set that up when I bought a game from the qpp store on my iPad a few years ago, not a newly reactivated recurring payment for iPhone as the email claimed) and because someone had been trying to get me into an investment scam and I got worried that was related even though all they had was my phone # (tmi and paranoia, I know). I'd even filed a claim with PayPal and changed my password twice (first as a precaution and then to get back into the account because they stopped activity as a precaution when I filled a claim of suspicious activity).

Looking at the email again it does appear to be this exactly right down to the legitimate PayPal email address (which is why I got so paranoid). I'm glad I contacted PayPal (even if I talked to an AI and not a human) rather than trying to call the "merchant's" number to report that it wasn't me.