It's alright. Most have been through this all he need to do is change his pw to something more complicated. He was lured to a phishing website so the person only has that one pw and not any other personal info. After that contact roblox [email protected] they can trck the ip of the account login and the person that login to the account from a different ip than regular. their account will be terminated. I was key.logged so I am a bit informed on situations like this.