Paypal does not protect Virtual transactions. As a verified member they will go thru the normal channels, but that is it.
From a legal stand point your screwed. The new process allows you to change the user name and initial email, with the pertinent information you should have done this.
IMO,call blizzard,tell them you purchased a character, this will create a dispute on the account. They will lock the account and start going thru their procedure. You will want to get a name and email that tech a screen shot or billing receipt from paypal as well as any evidence relating to the account, like emailed passwords.
Your ONLY recourse,since there is noway your going to pay what it would take to prosecute him, is to retaliate and get the account banned.