Is it possible that the sending address is being spoofed to show his address? This might account for why there is no unusual activity, the email host is not actually sending anything, but when it fails to deliver a response is sent to his address.