From PayPal to Your Platform: How Credential Stuffing Spreads Risk