I dunno how he can retract his money through paypal. You should only send to the address on file with paypal. The only way I know of for him to get his money back is for you to issue a refund. And by take payment through paypal they cover you against frauds and scams.