Tell him to contact BTC Guild with proof of what happened and they should give him his coins back. Generally pools pay back accidentally high transaction fees and this is a similar situation only the hackers mistake works in his favour.