He only has two IP addresses recorded to his account, one of which is a college IP and the other being (what is likely) his home IP. Now, while it is technically possible that a spambot somehow managed to get into one of these two accounts and thereby hack his account, it seems astronomically difficult compared to how they normally operate.