He can prove the identity man by signing message from his bitcoin address posted long before he sold the account.
This will not prove that he is the real owner as well because AFAIK he mentioned that some nasty 'virus' or whatever it is stole his accounts while some other version claimed that he sold the account. Not sure which one is correct but it doesnt matter as long as he refund all the stolen amount