Sounds like they sent him an email with an attachment, probably with a Trojan.