We received an email including the passwords and were able to recover the accounts and reset everything.It was whilst resetting all of the security information in the accounts that we realised the way in which he was continually retaking control of the accounts, was that he had put his email address in as the secondary email address in Google.