With a highly spoofed domain such as Paypal, you would not add this domain as an approved sender. Either add a specific email address from Paypal and or add a specific domain based RPF/SPF filter in Postini. See the admin guide section; RPF: Tools to Help Prevent Spoofing