This is the thing. The only thing that come to my mind is that the attackers knew previously his wife. Since the email is not a common one like info@... or contact@... it sounds difficult to me to find.

Another possibility is that some bot is buying discarded domains and trying to restart password with different combinations