It would apear that the account was hacked and forwarding set up.
Email accounts can be hacked in any number of ways so it is imposible to say how his account was hacked.
You need to remove any forwarding email addresses and after doing that change the email account password.
I would also suggest changing banking passwords etc as well as contacting the bank and any other company to advise them of the hacking.
The banner that flashes up is to alert the account holder that forwarding or a rule has been set up or changed per chance the account holder was not responsible for doing that such as in the case when it was done by a hacker or other person without authority.
It flashes uo for a few days so as to try and ensure the account holder sees it. It can not be turned off.
His contact list will have been stolen hence they are receiving emails purporting to be him in order to dupe his contacts into feeling it is genuine and respond to the email which in turn would be forwarded to the hacker.
All he can do is advise his contact about the hack and be aware that any emails from that adddress may be a scam.
