Its hard to really give a meaningful answer without seeing the email. You could check if the attacker was sloppy, and allowed information to leak in the email h

Its hard to really give a meaningful answer without seeing the email. You could check if the attacker was sloppy, and allowed information to leak in the email headers, but its quite likely that your brother was emailed by another victim. Its much more important right now to assess the impact, and to contain any breaches that have occurred. If your brother and his colleagues were infected by malware upon clicking the link, their IP may be in jeopardy.