Maybe his computer was on at the time, logged in on his Gox account? Someone might've taken over the computer.