Do we know for sure that it was sold? I will unlock it if he will be able to prove that it wasn't hacked by going through the recovery process, however, my "hacked" radar is off the charts

All I see in the seclog is the account woke up, but I'm sure you have access to older records. If it was hacked wouldn't the password have changed also? Just an email change doesn't really mean much in my opinion.