This sounds as if he's using webmail, not Outlook (Express). With webmail you would not need access to a computer just to send emails... And of course with webmail you can protect your own computer with dozens of antivirus stuff, get install several firewalls, Fill your system with antispyware tools and ad-removers and still your webmail would be vulnerable since it's NOT located on your own system. So no matter if his computer was on or off, with webmail it doesn't matter.
Run some anti-spyware as t.ex. spybotSD and Ad-Aware,to remove key-loggers, then
So far as you have access to you e-mail acount-->> change login password to you e-mail
Bookmarks