The presence of credentials in leaked "stealer logs" indicates his device was infected.