If I remember correctly the email doesn't include the username, can have him try to manually check everything he thinks it might be by going to https://steemit.com/@[GUESS]

If he knows what day he created it, he can search the blockchain for the accounts created that day and see if it stands out.