norton isn't great tbh, and as his email i assume is an internet account gmail etc? then it won't do much re protection.
he should contact his email provider, change his email and get 2 factor authentication to log in.
duo app is good fort this.
he should also update any other account that might have similar password to his email also.