Friends account hacked found on OSRS botting.. help?

My friend who normally plays RS3 has recently been hacked and can't access his account, I see the account online on the OS servers I looked at the highscores and only saw a crafting level on there so I assumed they are botting bowstrings and was correct when I went to the world and saw them in lumbridge, can any Jmods help?