whitespace (spaces/blanks etc) are ignored in HTML so you shouldn't have been able to see them.- - There are 10 spaces between these two characters as I type them. Can you see them or just the one?
I'd look at something totally different. Check his IP addresses for the last say 48 hours. You're looking for an IP address which is not one of those he normally logs in from. If you spot one, wash it through the> search for user by IP address <and if you get a hit go from there.
I think somebody got your password. Might be prudent to change it.