I wonder if he realises that browsing over Tor with IceCat will be causing him to have quite a distinct browser fingerprint. He should just use Tor Browser.
There is a lot more than just the useragent when it comes to Tor Browser versus any other browser. Tor Browser has many changes to try and make every instance of Tor Browser look identical, everything from the HTTP headers to window size to timing functions being rounded uniformly. Although I am guessing he browses with javascript turned off, which does defeat most of the fingerprinting techniques.