Make absolutely, positively, 100% sure that there is no residual malware on the computer. An advanced rootkit could even survive an OS re-install (AVG Rescue boot disk/usb is good for deep scans). You didn’t mention resetting passwords, though you probably did that. Check any accounts that have a phone number…