Until he shows a signed message or a non-manipulative proof that the account is his, he should not be given the ownership of the account.
Edit: And as the person above me said, even if he does shows proof of ownership, a recount of how exactly the account was hacked would be necessary and an explanation as to why he turned a blind-eye to use of his account.