How did he get pwned or not take necessary precautions? He could have re-imaged it after running the virus to prevent something like this from happening (assuming that's how it did), but it was all in a virtual machine, so there wasn't much risk to not doing it.

Disclaimer: I'm not a professional virus analyst.