I have a couple of guesses.

1: Someone is already in his system and has retrieved his banking info from when he used it online.

2: He has signed up for some service online and has given out his account and routing info. I once saw a scam using an online music service that asked for this information for a monthly music download service....they gave you kazaa light and some other free software for a monthly fee and you could download all the music you wanted 'legitimately'.....yeah, right.

3: Someone may have stolen some mail and is having a little fun at his expense.

Any way it goes, it might be advisable to simply check his machine for any type of trojan, get him a firewall, etc. And then maybe have the bank set him up a new account and transfer his funds over.