If his correct email address is in his profile, can't he just click the 'I forgot my password' link ?