You got them to change their pass, and then give you the new one so that you could log in on their account and then buyvthem a lucky dip using your own paypal account, then once that was done, you got them to change it back. People do the same for toriprime.
All in all, the only way you could have done credit card fraud, would be if the money on your paypal was frauded. I highly doubt that.