If an angry mob smashes up some shops fronts, but police only catch 14 people you wouldn't charge them with the total damage of the entire mob, as well as the cost of upgrading security to protect against an angry mob in the future. You would charge each individual according to the damage they actually did.
No, it's not just about making the target of the attack whole, there is also a punitive aspect in order to discourage others in the future. The actual amounts in this case do seem excessive, but it has to hurt enough that future "anonymous cowards" seriously think twice before jumping in. Part of the mob mentality is thinking "there are so many of us, there's no way they'll catch me" and this shows that's just not true.
Look, I dislike PayPal as much as anyone but vigilante mob justice isn't the answer and there has to be more than a slap on the wrist.