EDIT: This wasn't completely his fault, since wallets are suppose to create 100 addresses for you to use, so the second address should have been in the backup, but there was a bug.
I'd just like to clarify this: There was
NOT a bug. This happened before the 100 address pool code was added to the standard bitcoin software.