What actions can and should be taken following a hacked gmail account?

My gentleman companion’s gmail account was hacked yesterday. Somehow, someone got his password and used it to enter his account, change the password, and maliciously message his friends and family.

He went through the proper channels and got the account back through google, but now a lot of his friends are having mysterious, seemingly related security issues. They’ve received emails asking if they really wanted to change their password or in some cases have had their accounts illicitly accessed.

I was under the impression that gmail was pretty safe. Do you guys know how this could have happened? Is there a recent security issue with gmail? What should he (and everyone he’s ever emailed) be doing to keep their stuff safe?

Also, we have the IP address of the kid who’s doing this. Is there any legal action that can be taken?