Could he try switching to something like Trillian? Trillian isn't AIM but sends AIM messages. Or would it share the same security holes? Just a shot in the dark...