I don't think he did learn his lesson... I thought everyone knew by now: your account security is only as strong as it's weakest link.

Account recovery and 2 factor auth is always that week link. If you don't want to get hacked in this unsophisticated way just because someone is targeting you - then just remember your password the old fashioned way and close all the other doors. even postit notes are more secure because they are not remotely exploitable.