Paypal is hackable, as my company experienced a
rash of orders whose billing address was in
Florida, but items were requested to ship to
russia.  If the users confirmed address (not sure
if this is possible outside the US) matches their
shipping address, all is good.  If not, request
that they send you a money order, or use bidpay,
or westernunion or something.