Went through the same thing and as an international user was quite intricate. That was after reporting the email as phising, changing passwords etc. they confirmed it was required. Still, be vigilant. I never clicked on an email link etc and only worked through my Paypal account through the notification on my profile knowing I logged in securely etc. Just checked, May this year I went through this process.