Your son should try to establish how the account was taken over in the first place. The website Have I Been Pwnd
https://haveibeenpwned.com/
allows you to check an email address and see if it has appeared in any data leaks. There is also a password checking feature too.
Once an email/password combination had been accessed, it is often used to then try to take over other accounts and online services.
This is a particular problem for people who have reused the same email/password combination across multiple sites and services as the hackers will take those details and start trying them on other sites and services to gain access. This is reported regularly on the forums.
If your son has reused the same email/password combo across different sites and services he should look at changing those as soon as possible as well as changing security questions/answers and setting up two factor authentication where it is available on his online accounts.
