I'm taking a guess here, it's probably a phished account. The subscription active meaning it's being paid monthly so he would've cancelled it before paying for it, instead of just being a 1 month or 3 month or 1 year membership. Also the recovery questions was changed, so that he can try to keep the account when he phished it, and the email is the same because it would take 3 days to change it and the original owner would realize, or he already changed it. this is my opinion, Deal with caution