Did you see anything that caused his account to send spoofed emails?
Combofix definitely removed some infection.
If that was the cause I simply can't tell.
Only time will show.

Any current issues?