I had some waterjet cutting done, handed my card over for payment, the guy signed into PayPal, input my card details, asked for my email address and voila.. bill paid.
PayPal charged my card (it's a way for small outfits to accept card payments, they pay a small fee to PayPal) and sent me an email receipt.. same as they do if I buy something using them..
If your card is linked to your PayPal account, and you assert it was your PayPal account that was debited rather than the bank account your card is linked to, then you might well find that PayPal saw the incoming card details, matched it to their records, and charged via the PayPal account ecause it's cheaper than doing a card acquiry. If they have permission to debit your bank account via direct debit, at would be a cheaper way of getting payment from your bank than going via the credit card
All in, it's not possible to take money out of someone's PayPal account using their email alone, with no additional authorisation. There's some part of the paper trail/sequence of actions you've overlooked