#1 - Sept. 13, 2010, 9:03 a.m.
This has already been locked up and put into process.
The fact they added an authenticator is a sure sign they are into his email account.
He needs to make absolutely certain his system is secure - and then either secure his email or better yet, set up a new one from a known secure system and then change it on Battle.net.
This sticky may be useful.
Account Hacked? Security Issue? Look Here!
http://forums.worldofwarcraft.com/thread.html?topicId=24702231244
You may also want to look into getting an authenticator for your account. It's no substitute for good security habits, but it will help keep them out of your WoW account.
Blizzard Store
http://us.blizzard.com/store/browse.xml?f=c:6
Mobile Authenticator
http://us.blizzard.com/support/article.xml?locale=en_US&articleId=26109