I kept his account unlocked because I thought his family members might want to look at his PMs or something, but this is looking like his account was almost certainly compromised. So I locked his account.

The person who controls his account gained access via email-password-reset, so his email is probably also compromised.