Completely agree with you there, just last week I had someone get into my ebay account and but a load of digital playstation codes. I wasn't aware of this but apparently the default for connecting paypal to ebay was to auto-sign in. Luckily it all got sorted and I was refunded.
In terms of VMP im going to wait for the next payment and see if it comes out of paypal, if not then I will get in contact with them again.
Ouch! Yeah it is. I wonder can you disable that and force it to make you sign in every time?