If that's exactly what happened, then he's still to blame. There's no way to trust someone who lets someone else cheat on his account.