He's been hacked (we've all had lots of rogue messages).
The hacker has changed his password and email address.
He no longer has access to the original email account.
FB have spotted the unusual activity and frozen the account (which he can't access anyway).
What does he need to do?