So wait he had $25k and he did not have his F2A enabled! Even if his email got hacked no one should be able to access his account if he had his F2A enabled, something is not adding up here. I would say that he was dumb enough to press on a fishy website and tried to log in from that bad fishy website and that is how he lost his money.