LOL. Actually he has paypal. And the password is the same. The e-mail address is now available on his profile.
I will not, however, send money from his paypal. I consider that too illegal to do. (He has about 60 EUR.) Theft is theft and I have no reason to believe that he already managed to scam someone. If he had, I might have transferred the money on another paypal account to hold it until this is resolved.
EDIT: Oh, and some additional info: on his gmail account he had this password once, but it was (according to gmail) changed 3 months ago.
I quite agree. However, I would change his passwords on paypal and gmail. If this is a hijacked account, you will actually be doing the real owner a favor. And it will prevent anyone else reading this thread from emptying his account. He might deserve it, but its not up to us to do that.