Submit a DQA and ticket to both GamesCampus and Redfox. That's your best bet. When he gets his acc back, be sure to turn on 2nd verification for email and make his rf login more complex. Edit: Unless he gave his information away.