What is his password like? The chance is he is using similar password for the other domain. What services are running on the domain server you have access to?