Yes, it sounds like you have a good SOL defense, but better than that, you paid the debt. Send the debt collector a certified letter noting that's been 7 years since you paid this debt off, with a copy of your bank statement and advise them that if they contact you any more, you'll sue THEM for violation of state and federal debt collection laws.
Please see this question and answer, and the one lined within it.
Disclaimer: Please note that this answer does not constitute legal advice, and should not be relied on, since each state has different laws, each situation is fact specific, and it is impossible to evaluate a legal problem without a comprehensive consultation and review of all the facts and documents at issue. This answer does not create an attorney-client relationship.
I am not sure what letter you sent to the debt collector, but the facts you describe are a classic dispute that Congress had contemplated when it approved the Fair Debt Collection Practices Act. If you have a document that shows you paid off the debt, I would copy that and send it with my sample letter 1.1 as soon as possible and explain that the debt was paid in full in 2003. I would also request any documents that show any charges to the account after your $0 statement date.
Your facts do not indicate if the account was closed, after you paid it off. What if someone accessed the account and charged on it several thousand dollars? You need to get more information on this, because you may be the victim of identity theft. The second link below is to my Legal Guide for victims of identity theft, which may also help with your research of this account that you can prove was $0 in 2003.
Until we know when these charges occurred and when the account was considered in default, it is premature to determine if the debt is older than the statute of limitations, which for a California credit union, would probably be four years from date of default.