@Jez123 One of his sites lots of schools use for exams that they have behind password protected sites. So it is an authority of sorts in the niche. So he sees a lot school and university traffic to it and as you said any search that came to him during that period where searches by people looking for the site itself.
Why this site got hit in the first place is anyone's guess but it came back with a vengeance this latest penguin 2.1 update.
The other two are not the biggest authority sites in the niche. His competitors have better sites and he fully admits this. Interestingly his competitors have been wiped out and his sites are back.
So now in every niche he has two sites sitting in the top 3 results for most of his long and short tail money terms. Which has him worried in other ways LOL. I told him most webmasters and SEO's would love to have these kinds of worries after a penguin update.