Or he could have been hacked. Someone probably left their computer open or logged on somewhere. I've seen it happen before.