We don't know he accessed his MEW. He could use private key or seed which won't require any password to unlock.
Either he got phised or keylogged.