Well, if he was trying 1M combinations every 40 seconds, for $7 per hour, and he didn't need to use hundreds of dollars per hour of commute time, let's say 10 hours = $70. That's 900M combinations per hour, so 9B combinations in 10 hours.

If he was trying combinations using upper-case characters, lower-case characters, numbers, and let's say 20 symbols, that's 82 possible combinations for each one. We'd expect him to find the password after exhausting half of the search set, so we want log base 82 of 18B. That suggests 5 characters.

If he let's say just used lower-case characters and numbers, that's log base 36 of 18B, which suggests 7 characters.