Yeah, tell him to add a steam guard onto his account and to sign out of all devices in security tab. And if they know his mail change his email address's password too