Recently I Googled the email address of one of my friends, as I was just curious of what would come up. Lo and behold, he saw what presumably is his Gmail hash. It is part of a list of 10,170 email addresses and hashes. First of all, I was kind of surprised that _Google_, of all things, would be compromised (or is it?). Phishing? He reported a few weeks ago that his email account had been sending strange emails. Something bad is obviously going on. What should he do?