Or you can just get off his account because he payed for it.And even if you do get into his email and steal the answer all he has to do is contact mojang with proof of purchase and you're screwed.You think they don't log the ip's that are connecting to accounts?So when they see the foreign ip you are done and he can press charges for theft if they want to.