Even if it's unconfirmed, since he bought membership, there's an 'Order Number'. If he can find that email, and prove the account is his by showing it to AE, then he can still get it back, and they will tell the original owner to make sure he confirms his email this time.
Since the owner of the account has the transaction ID, he/she can get it back right away. However, expect the account to get banned. If you haven't done anything to it yet, I'm very sure the owner has also been using Le Bot or some other bot or a trainer.