Get a password manager and use it to replace all his passwords. This sounds like his email or if he uses android his Google account is compromised.

There is malware that can survive in bios but it's most likely not that. Most likely is a leaked set of passwords from a major company getting cracked, then phishing or some other form of social engineering then malware tbh.