Sounds phishy to me.  Any email that prompts you to click an included link and then log-on is considered a no-no.  This being done now, however, at least you haven't compounded the matter by giving them your password through their log-in.  If you're worried about your Paypal account, log in...