It seems like the scammer suddenly wanted to take the first email address out of the equation.
do you really think so ? well , I don't.
I highly doubt that this is how scammers go about running their daily "business" , they must have planned all of this and there is not a single reason why the scammer would return 500$ and keep 1000$.
I am not totally denying the possiblity of your "theory" but on a scale of 10, i don't think it qualifies to 1 in terms of probability.
There's no harm in iChanger reporting fraudulent activity on all 3 of the email addresses he received to PayPal.
True, however the refund part is not clear at all, the refund was either charged back real quick which makes his claim about the transfer being "Friends and Family" most likely a lie, the other possibility is that the alleged "scammer" did send him the money just like that ! which then brings us back to the question of WHY ?
I think only Ichanger can really clarify this matter.