We think that we have narrowed this down a bit more. There are two places that we order take out food from. One is a Chinese place and the other is a pizza place. We normally use our debit cards when we order from either of them. The Chinese place and the Pizza place both have had a good bit of employee turn over lately. We think that it's more likely to have been the pizza place.
Other than the "temporary" PayPal account that was opened in her name with a different address that they purchased something for $39 and then had a refund for $39 show up in her account, there were iTunes charges roughly $5, and charges from some odd website domain provider for about $84. The website domain owner has been contacted and has shut down the website that had her name on it as Corey*******.com None of the purchases that were done under her name included her middle initial, which is the way all legal transactions show up for her under all of her accounts. Corey cancelled her PayPal account even though we doubt that it was compromised, it just happened that the thief was using PayPal as a method of using the card for their own gain. Corey also cancelled her iTunes account, just in case.
Corey is pretty diligent about checking her account online daily, so I was surprised that she had not caught the initial $39 PayPal transaction. Luckily, she caught the $39 refund and the other transactions so quickly. This could have been much worse.