If I ever move to the USA...I will KNOW to not set up an account with BOA.
Playing devil's advocate here.

I doubt that BOA is entirely at fault. Paypal had been authorized to remove money from this particular account in the past - so why would/should the bank question this particular transaction?

If the account had a withdrawal limit, say no deduction over $600 without contacting the owner, that would be another story.

This is why we do not allow any company (electric, cable, etc.) access to our bank account.