Further, I looked at the address that i received the coins in originally and it has a balance of 0.00. I did transfer half to someone, but half went to another address on the same date, i dunno if i was hacked or if i am just reading this wrong. The core wallet only shows the receiving transaction and then the one i sent. I still have the email from them confirming their address. The other address the funds are still sitting there.
Obviously, the second address is your change address since the remaining funds were sent to it at the same date and still sitting there.
From the console type:
listunspentIf you see the change address there then your funds are safe.
type:
dumpprivkey "change address" to get the change's address privatekey.
edit:
...
If he does not know what to do after that, then it would be better to start using an easier to use wallet like Electrum. All hé has to do is to import the private key into Electrum.