More likely he was a victim of a phishing activity.Contacting paypal support and asking them to check the transactions and the IP can save his money.However,the money in paypal account might be chargedback from previous transactions if the "goods" option has been selected instead "service/other" so paypal may not be able to do anything about .t