Hacker sent him a email with attachment.
Their was a keystroke Trojan that recorded all his data.
I encourage everyone to never open attachments.
Not even from a administrator.
Scammers have cloned staff emails for years and found ways to forward staff communications with malice intent.
DWBO