I don't have anything particular to add, with respect to breaking into the locked NT account, but I'll note that this sort of thing happens with enough regularity that any reputable business, and that includes PayPal, will have a process for resolving the issue. No doubt, it will require way too much legal documentation, but it's always going to be possible.

When pursuing this sort of thing, you first should regain control of the email account(s) and cell phone number(s). The latter might be recoverable simply by popping the SIM card into a fresh phone. At that point, you've got what you need to "forget" your password on other sites and deal with most common account recovery procedures.