TVYM for the suggestions & responses, Ghisallo, Lewintelamon & ALaggyGrunt.
It turns out, his main account was fine, it was the first subscriber account he created at launch that he left inactive that got hacked. He's following the steps outlined by Lewintelamon and seeing if BW will merge the accounts.
I told him to get a security key.