This is how it could have happened.
If your account was used fraudulently in the past, the crook would have put his or his forwarder’s address in the Ship To field. You may have gotten the hacking straightened out at the time, changed passwords, etc. but nobody told you to check your shipping address next time you made a purchase.
Then some time later when YOU actually went to buy something, the last address that was used (in your case by the crook even months ago) would have been prefilled in the Ship To field. You just hit Send Payment like you always do because you never used an alternate address before so didn’t think to double check the address.
So the rugs you bought got shipped to the forwarder in Ohio. What you need to do is go to your PayPal account and find the link for previous addresses used. See if that Ohio address is there. I don’t know if you can delete it but see if you can.
When you go to make another purchase, click on edit or change or whatever it says next to Ship To. There you will see all the addresses that have been used in your purchase history. Select your address and it will default to that the next time you pay.
I bolded the part above about the last address used default because this issue comes up quite frequently. Many people are under the mistaken impression that their registered eBay or PayPal address is all that matters. Clearly it is not. Any address can be manually entered at checkout.
