To provide any guidance at all, you would have to tell us the system or site the password is for.
What you can do is, on the computer from which he made the change, go into the options of the browser he used and see if the password was stored there ...