He's got a malware infection.  Take off and nuke the PC from orbit.  Only way to be sure.

Seriously, you could try downloading some AV and detecting and cleaning it, but depending on what got installed, it could leave hooks in there for good.  So you should clean it off immediately just to keep it from spreading itself more, then consider reinstalling the OS, installing some decent AV, then restoring any old documents from backup.  Even Windows Defender is better than nothing.

Oh, and switch him to Firefox and use NoScript

It's likely the infection point was a drive-by download on the site he visited.  Having the malware payload attached to the email itself is possible, but it's not as common, and when it is, it's usually a straight up trojan executable. 

Whatever got on the machine could potentially have gotten full control though, so even if it's not necessarily the message itself that's the problem, the malware on the machine could have any amount of access to email and more, such as any passwords typed while the malware was active.

Probably.  I'd at least change the most sensitive passwords anyway just to be sure.

I dont know why people fall for this
I mean usual email spam is like ridiculously easy to spot... I guess if you dont know that the sender email can actually be fake you could be tricked
never click links, never open attachment unless you really know what it is

but I know even those spam emails that you get from friends email account and the phrasing is so obvious and weird to me that I spot it immediately

fishing emails, I can understand if you're not familiar with them, but its 2012...

Sender: Microsoft
Subject: Is your e-mail account safe?

Do not open that sort of thing. Microsoft doesn't just send out mails like that ^^
So many fall for obvious ones like that. Sender names are very easy to create

Vigilance is all well and good, but I myself am probably a late evening and a drink away from falling for a phish someday, at least the first click, which may be all it needs.  I heard the same thing in a keynote address from a security researcher, and I don't think you and I are necessarily any better than him.  It turns out that moral disapprobation of the target's gullibility has, over the ages, never really been a very effective security policy.

Nop, if it contains any keylogges it just reads the new password.
Not that it matters, it probably has root acces anyways.

If i was you i would change all passwords (known and entered on the infected computer) on another computer (email, forums etc).
After that, dont use the infected computer untill its cleaned.

I do anti-spam for a living, and for years it was with an emphasis on phishing, so I'm perfectly aware of how to be safe.  Still it remains that a lot of financial institutions don't seem to know or care about best practices like not including direct links to online banking in their emails.   Or the case of PayPal, who actually does scrupulously use DKIM, yet doesn't pay too much attention to how suspicious the actual content often is. 

You can easily 'spoof' the link in the email too, like:

https://paypal.com/

yeah if its like a short url/acronym you could miss it like "paypal.com" but its referring to "paypal.ytmnd.com"


Also, I guess you guys also get the spam mails which are like "Hey I'm from China, and I have $47385624856, I need you to move it for me" or whatever
those never have links - what do they hope to accomplish ? What IF I reply ? :D

You'll get a reply from a human who will elaborate the scam further.  I read an interesting interview with a Nigerian scammer, who revealed a really interesting fact: a lot of them speak much better English than the terrible grammar and clumsy pitch in the emails would indicate, but since they actually get so many responses anyway they deliberately phrase the pitch in such a way that only a fool would fall for them.  In which case, the responses they get back are from those fools who are inherently easier to scam.  So despite what I said earlier about phishing, you do actually have to be an idiot (or otherwise deluded) to fall for 419 scams, because they're actually screening for exactly that.

Incidentally, if you want to see the hilarity that results from people who do reply to the scams in order to screw with the scammers, check out 419eater.com