[gruez]

>Was his ledger manipulated or compromised in some way before using it? Was the seed already pregenerated?

The timing of that (ie. two separate wallets compromised at about the same time) makes that unlikely. What are the chances that the guy who shipped him a compromised ledger is also the same guy who hacked his iphone?