The fact that he was using your friend's Paypal account is a separate matter. That also could be a crime (theft) as it happened without authorization, but I'm sure you've heard the phrase "two wrongs don't make a right". Responding to one crime by committing another one doesn't mean that the second one was not committed. It could make a judge more lienient, or a prosecutor less likely to prosecute in the first place, but it is not a defense that would get you out of prosecution should it arise.
Minnesota (the law that would apply as that's where the crime occurred) has its own computer crime statute, Minn. Stat. § 609.87 et. seq.
609.891 UNAUTHORIZED COMPUTER ACCESS.
Subdivision 1.Crime. A person is guilty of unauthorized computer access if the person intentionally and without authorization attempts to or does penetrate a computer security system.
Subd. 4.Misdemeanor. A person who violates subdivision 1 is guilty of a misdemeanor and may be sentenced to imprisonment for a term of not more than 90 days or to payment of a fine of not more than $1,000, or both.
Now IF this was ever prosecuted, neither she nor you would likely get any jail time. That's the maximum amount that could be applied, and if it's a situation such as yours, it's unlike that the judge would actually impose any jail time. Community service might be more likely. And in light of the reason, again, it's less likely that the prosecution would prosecute, but it's by no means a sure thing one way or the other. So yes, it is possible that you could be prosecuted. It's not in the "harm" but the access to the account. The moment that you do so without permission, that is a crime.
I know this is probably not what you wanted to hear, but it is the law. I hope that clears things up anyway. If you have any other questions, please let me know. If not, and you have not yet, please rate my answer AND press the "submit" button, if applicable. Please note that I don't get any credit for the time and effort that I spent on this answer unless and until you rate it positively (good or better). Thank you, ***** ***** luck to you!