His password was probably “password123”...
And his two-factor authentication was...turned off?
It would be funny to find out what weak sauce he was using for a password!