Damn, that’s a really bad news, seriously. That’s why if you’re storing your keys in a place online, it’s best to make use of a platform that won’t delete your files straight up when you click on the delete button, but rather move it to a trash page where the files can stay up to thirty days before they delete automatically. That way if you make this kind of mistake you will be sure that the folder or file has not been completely deleted and can easily be recovered from the trash section of the app.
Another important thing to do is to write it down on a piece of paper or something like that. As for those helping him to recover it, I don’t think they can steal and hide it, because he will be ale to check his address on blockchain and know when the coins there are moved.