Recently I Googled the email address of one of my friends, as I was just curious of what would come up.

Lo and behold, he saw what presumably is his Gmail hash.

It is part of a list of 10,170 email addresses and hashes. First of all, I was kind of surprised that _Google_, of all things, would be compromised (or is it?). Phishing?

He reported a few weeks ago that his email account had been sending strange emails. Something bad is obviously going on. What should he do?