1) He goes on about how secure his password is, but then admits that someone got into his secondary email account. His secondary account should be just as secure. This calls to doubt his security savvy.
My backup email received some "password reset instructions" emails for my main google account. - eg someone clicked on [forgot my password] on google, and entered my account name.
2) "loose" instead of "lose" -- always a bad sign