Wait a couple of weeks, or months depending on how paranoid you are and just leave the account there. After 2-3 months of not logging on, see if he's recovered it. If he hasn't yet, put new recovery questions, a new password (change it a couple of times) change the email, and most importantly try to give it members and save the code they give you so you can provide it to them later in case it might be needed.