hijacked because they figured out his phone number and then were able to get into his account and change the password.

I use the authentication apps like Google Authenticator or Authy. It can be a pain if you lose your device but they are more secure.