If your friend thinks his account was compromised, tell him to email support[AT]spacetimestudions.com
They can look into his accounts login history, devices using his account, etc. This sort of thing can be guarded against by using a strong (random strings are great) password, and not making your email address public.