All he can do is to file a support ticket and prove he's the real owner, by providing details no one else would know.

This whole thread could also be a phishing attempt by someone who knows the email address of an account and is attempting to find out how he can retrieve the password.

It's the internet. doubt before trust.