Order for a non-existant product

One of my shop owners just reported getting an order in her store, even though she has no products set up yet.

The order is not associated with any products in the manage orders screen.

It says this:

“January 1, 1970 – 12:00 am: 7: Completed: The payment has been completed, and the funds have been added successfully to your account balance.”

But has a legitimate looking address and email address.

However the shop owner has checked her paypal account and there was no transaction.

Is this a weird bug? A scammer? A security hole in the software?