Maybe he did a password reset, and they sent him his actual password.