Something's up here...
Assuming it was a Google account with 2 factor enabled, you aren't allowed to reset the password with an SMS only.
You need two factors. I suspect his original password was leaked, or perhaps he had a recovery email address also broken into?