All that stuff about how to trace what by whom and when is all very technical and impressive ....but......what if he just had a visitor in his house who downloaded the stuff? Since when are computers used by one user?
I'm going to presume it's all a horrible mistake until proven otherwise.