It wouldn’t matter...the issue is they used 2factor authentication to logon as him once they got his phone # all text validation messages were sent to his phone.
There are better ways to do 2factor authentication. SMS/Text is the worst way.
Always email for me, they get into my phone they still need to know my password to get into my email, unlike text.