Actually, it is possible that he was being used by the actual culprit as a Zombie, which means his comp was being used to hack the comp by the culprit because of a backdoor in his comp.