If you still have access to his Steam Support account say something along the lines of "my email and steam were hijacked, but I was able to get the steam back before my email was taken. anybody that posts a message trying to gain my steam account "back" is an impostor. My new email address is [email here, don't forget to update it in the Support account settings, should be same as steam account email] if you need to follow up. My old email is compromised and is no longer owned by me, unfortunately. thanks."
if they dont buy it, oh well. They very well may ask you for verification, if so, you could try to weasel out of it, but in that case good luck, you'll need it..