I just got bit by this as well. Thank-you for the detailed description/solution.
The payment form does explicitly state "username" and "typically and email", however I do believe that Paypals documentation suggests using the MerchantID in cases where you may want to hide the email address. Normally I see this where "jane@big.org" (Jane at some big organization) has set up the account, but after Jane leaves they want to change to something a little more professional (
payment@big.org). Paypal does not allow for changing of email addresses (at least no easy way) so I usually just have people use the MerchantID, make "payment@big.org" and "jane@big.org" synonymous, and move on with life.
I put this out there for the PayPal Module Developers consideration... Merchant IDs have a place and people will think they can use them. Does it matter? Not sure... It seems invisible for the most part anyway. Maybe a note on the config page? DO NOT USE YOUR MERCHANT ID