2 of 2 deleted 81 characters in body; edited tags

Hash leaked online

Recently I Googled the email address of one of my friends, as I was just curious of what would come up.

Lo and behold, he saw what presumably is his Gmail hash.

It is part of a list of 10,170 email addresses and hashes. First of all, I was kind of surprised that Google, of all things, would be compromised (or is it?). Phishing?

He reported a few weeks ago that his email account had been sending strange emails. Something bad is obviously going on. What should he do?