If his is a webmail service (e.g. gmail, hotmail), it's likely that the crims have taken over his actual account, either by guessing/attacking his password or by a trojan on his PC. If so, they'll have changed his email service password and other security details, making it very difficult to recover. I hope he didn't use the same password for anything financial. Have you any way of contacting him besides email (which he now wouldn't be able to access)?

Team members are reporting that they also contain a Trojan.....do not open them!

One of my PCs used by the wife was infected with a Trojan that involved Java and it got all of her email addresses and is now spamming her list.
That's bad enough but the sending address is hers so everyone thinks she is the spammer.
Getting a lot of bounces from businesses (QVC, etc...) on her list that don't accept incoming emails at there newsletter account.
The Trojan did not show using Avast AV, MalWareBytes, SpyBot S&D, or WinPatrol.
However, it was detected on a scheduled Boot scan using Avast.
The source was an email from someone on her address list that was infected.
If you think you may have been exposed try the Boot scan.