Here's a better solution: get control of yourself. Or, failing that, log in one last time (without reading the juicy details). Change his password, then log off; and the next time he logs in, the email server will reject his attempt.
He'll be forced to do one of two things:
1. Reset his password online, using whatever security questions he has established.
2. Call tech support to have his password reset, after providing verbal confirmation of his identity.
Either way, you won't have access to his new password, and you'll never have to bring up the subject.
Then think about why you kept going back to check up on him. Maybe things weren't quite as final as you thought they were; but they are now, and for your own sake you need to move on.