Tell him to go to the Steemcleaners Discord channel. If he edits all the phishing comments sent from his account to make them harmless (just replace the existing phishing message with ‘spam comment deleted’), they can remove the flags, reinstating his rep score.
Make sure you tell him not to delete those comments, slnce they can’t remove the flags when the comments have been deleted.
(I fell victim too, that’s why I know 😉)