Friend's email account compromised, sending scams

A friend of mine, an elderly man, 'sent' me an email today asking for help, I replied, and it became clear his email was compromised.

Long story somewhat short, we've reset the passwords multiple times but emails are still being sent from his email. It isn't just spoofing, I can see failure notices coming into his inbox from attempts at sending more scam emails (and presumably many are not failing, and still reaching people)

Edit: I did find some rules/filters that were deleting replies from people and failure notices automatically. But I don't see anything that is sending within the webmail settings of his service.

How can I stop his email from continuing to attempt to scam his friends and family?