A simple explanation: his sessions were hijacked due to the first hack, he never cleaned his PC of malware (infostealers in this case) or his tokens/APIs
even if he reset his passwords, it will keep happening
at least until he clean his PC or factory reset it