You're only safe if you transfer his char on another account (with PTC), or when you manage to change the last name on the account.
Now he can call to blizz and say his name/account name and Secret Question/Answer. And if he doesn't remember his SQ/a he still can recall it by giving the last digits of the CD-Key(s).