LOL. Actually he has paypal. And the password is the same. The e-mail address is now available on his profile.

I will not, however, send money from his paypal. I consider that too illegal to do. (He has about 60 EUR.) Theft is theft and I have no reason to believe that he already managed to scam someone. If he had, I might have transferred the money on another paypal account to hold it until this is resolved.

EDIT: Oh, and some additional info: on his gmail account he had this password once, but it was (according to gmail) changed 3 months ago.