If he knows forum id - yeah.
If not - he can't. Paypal txn+ bot id+forum id + email is required to change pw. Or loging in site with forum id
So u are quite safe, but why u doing such thing with email ? Paying with same email as u have on sbot account ? Better change it