From what you’ve explained, it does sound like theft. But theft by the person using your account, not by Envato. Envato will have had a request to deposit $300 into an Envato account, that request will have been forwarded to Paypal, and then that payment (and all the security procedures that entails) will have been handled by Paypal.
I’m sure everyone here can appreciate your concern over this, and nobody wants you to be down $300, but Envato can’t just give you $300. There are procedures in place that need to be followed.