Just as a final update, we went to the branch today and he had to fill out a form stating he did not make the withdrawals, and asking if he had his PIN written down anywhere. Obviously if he answered "yes" they wouldn't have refunded it.
Just checked his account online and they already credited back the full amount. Only took a couple hours.
