just to know, your wallet was encrypted?
We don't know he accessed his MEW. He could use private key or seed which won't require any password to unlock.
Either he got phised or keylogged.
i cant agree!
if you have an encrypted wallet, you can access it, but when you move funds, the password needs to be submitted!
and this is for all wallet.
BitCoin core QT, also!