If he wasn't, he is now. It was most likely a phishing email, and he probably clicked the link provided.