Well, the good news: the solution is probably very SIMPLE!
The bad news: the solution is a bit tedious and annoying, but if he wants to put an end to this, then he has to do it.
So ya: he needs to RESET ALL of his devices.
Most of all, he needs to begin by factory-resetting the router, and then changing the default password for that router device.
NEXT... he needs to run the factory reset on his phone and laptop. For the laptop that may mean reinstalling Windows.
He also needs to change ALL of his social media and banking passwords.
NOTE: before resetting all these devices, he needs to backup any data, files, contacts, pictures. Because once he starts resetting everything he will lose the personal data.
That will solve it.
If not, be sure to let me or us know, as it may mean his router is being targeted with a known vulnerability.