This is probably exactly what happened. I bet he used Chrome as well. It doesn't really help that Google Chrome keeps history basically forever (on the order of months), even without signing into a Google Account.