I think I'm missing something here. If he reset the password and the email address of the account now points to his inbox, then how would the scammer get back into the account?