He should change his passwords ASAP!

I take it he put the master (owner) password away as I told him and can still use it to change all the passwords and stop the power down. Am I right?

Power down takes up to 3 months, so there's time to stop it. I guess nothing can be done about the lost SBD and Steem that was lost, but putting them into savings can prevent them from being sent right away, because the withdraw takes 3 days.

I recommend only using the posting pass on the site, and saving all the other passwords for times you need them. (I use keepassx to secure most of my passwords. If you are a security buff like me (and even if not) you may want to save your owner key into a separate place (encrypted usb key or a safe, or both).

The owner key is the one you can use to change all other keys, including the owner key itself, so that's why you should keep it extra safe.