Well if this is the case is there anyway to tell if his account was compromised during that time? He wasn't playing during that time period, the first time he logged in in over a month was sunday 21st march, can you check the ip that logged into the account during that time??
The account was not compromised at the time and the account owner is ultimately responsible for their account, hence the rules regarding Account Sharing as per:
https://www.jagex.com/en-GB/terms/rules-of-old-school-runescape