After the Amazon rep said "Amazon: This account has your information in it.", he never just tries to tell Amazon his number to see if that IS what is on the other account. Seems so odd to me. But regardless, as others have mentioned already, why would you not just cancel everything to get it sorted out like any other fraud that would happen?
He says he did cancel his card. I guess you're saying he should cancel his Amazon account? That's a bit of a drastic step, so I can understand not jumping to it immediately.
