If a hacker can upload a file, change the user's passwords and let the user check his computers for malware via for example ADWCleaner and Malware bytes and give the new passwords after cleaning.Hacker upload a index.php file in public_html of this user.