For the record, I said "I believe" ... but will post the link to testimony and a summary... paypal employee testimony Day 40 Part 2 around the 20:00 mark.
I won't list all the payments or money transferred that they went through, but here are the one's that IMO would be 'stealing' from Joey through the paypal account...
Feb 10th $900
Feb 11th $200
Feb 12th $800
Feb 12th $3000 - used union bank for transaction.
Feb 12th - $1000 - also from bank account
Feb 13th $3000 e-check
Feb 6th Dan requested payment (assuming it was for $800) … then cancelled it. Then on the 12th that payment of $800 was made to Dan.
Feb 10th - in activity log, User Reset Password. With IP addy. Showed DK's paypal record from Feb 10th, showing same IP address. 70.95.65.75 (we saw this IP address in Dan's Paypal records)
Another password change on Feb 12th. Lots of things with passwords going on from 10-12th.