I'm theory is he had some browser wallet for some eth thing he was doing or tested at some point.

When Google account was hacked, they were able to access said wallet to get his ledger seed information.

Rip