Maybe too snarky, but they could have simply called Apple support and gotten them to reset the password. If a hacker can impersonate a person, hopefully this guy would know enough about his mom to do so too.

I'm hoping they already tried the security question route and were unsuccessful.