Unfortunately the token on the phone can get wiped if the phone does a software update and/or if the cache on the phone is cleared (not usual for most people though).

Just to confirm though, is he actually trying to login with the emergency password? It's not actually a password, it needs to go in the special token removal page to remove the token from the account:

https://secure.square-enix.com/accou...vc/coercioncan

Unfortunately if he is trying that URL and it doesn't work he needs to contact SE via phone, email or webchat (phone/webchat is considerably faster than email), but unfortunately they don't operate over the weekend