If he’s cancelled his cards, how are they still billing him?
Canceling a card will definitely stop the problem, however it sounds like somehow they got a hold of debit card information. And merely changing the card number (as in reporting an old one as stolen) won't cancel automatic payments. It used to work that way, and then you'd have to update all your automated payments. Now the card companies do it for you. So changing card numbers does nothing.
I tried talking to a card issuer when we had the problem a few years ago with Avast auto-renewal. The issuer basically said I had to cancel through the billing company because we had signed up for auto-renewal. Well, long story not much shorter, during the time we had avast, we changed emails and the old one got forgotten about and we could never get anyone to talk to at Avast about getting the email on the Avast account fixed because they wanted to send reset links to the old email that we couldn't use anymore. So we called the credit card company back and closed the account permanently. When asked why, we told them it was because they wouldn't drop the auto-renewal at our request.