Following up on this: there have been hundreds of incidents of attempted fraudulent access to this user's account. All were successfully blocked by our security systems, which worked as designed.
But we had a bug that sent him a bunch of emails today (one per prior blocked attempt) when he changed his password. That bug is now fixed.