With just a password its unlikely since he still need the file if it's through MEW.
I meant that if remembering the password is the only issue in case he have the keystone, then he could use something that could brute force it. At least that's what I've heard but I never really try to do it myself. If he doesn't have any of those 3, then it's not his wallet.