Going to go and complete these steps now.

Did you see anything that caused his account to send spoofed emails?