They have been doing that for at least several
months now and each time they use more and more
refinated ways to prevent being discovered by ebay
and to fool the people who receive the e-mails.

Ebay calls this spoof e-mails. Whenever you
receive a suspicious e-mail from anyone asking for
ebay or paypal passwords, credit cards numbers or
bank accounts claiming that they are ebay you just
have to forward the e-mail to spoof@ebay.com and
this way maybe sometimes they will be able to
locate the hacker.