he could put any valid e-mail address in to retrieve his password as long as he is able to access it.
he could, for example send it to your e-mail address and then ask you to retrieve it for him, then resetting his password. Depends how much you trust each other!!
re-setting the password is very easy and anyone in CS should be able to do this for you...
it really is a matter of asking some security questions adn then typung over the existing password!
however they might try and fob you off to tech support! if so it may be advisable to try calling cs a couple of times... as tech support is 25ppm and they will not refund for this type of issue!
hope this helps!
dan