You can go to the website haveibeenpwned.com to see if any of his emails or passwords are compromised. It’s possible that he could have been hacked, but I would doubt that