Sounds like his nsec was compromised. Assuming coinos was a wild guess how. (Doubt that's how)