No, he didn't click play, he clicked login.

He needs to reset his password. His registered e-mail must be valid or he will have to do chat or phone support to update that. He is not using a security token so this happens to everybody who doesn't every once in awhile.

The instructions should have already been e-mailed to him but if not then have him do a password reset and all should be good.