I thought he might finish off there at the end with key passwords, like the email account that all the change of password notifications go to.

As once that one's compromised, you've pretty much been compromised everywhere on the internet apart from maybe banks that require phone or fax steps for password changes.