Could be his phone is hacked and rooted. Maybe he saved the key from the authenticator app to the cloud and his account there is compromised. Could be that twit

Could be his phone is hacked and rooted. Maybe he saved the key from the authenticator app to the cloud and his account there is compromised. Could be that twitter is compromised. Personally, I'd bet on his phone being rooted. If Twitter was compromised, they'd go after much bigger fish.