Changing his password since he was able to log on would have been the correct move.