SOLDIERX.COM Nobody Can Stop Information Insemination

So today at work i had to work on a clients server that had a "virus" it was a mail server that had a program installed call Advanced Mass Sender sure someone has hear of this. So after looking into who and why this app was installed i found this IP 82.128.85.175. Now the email that was sending out had a signature with this guys name in it Ike Ekweremadu.

So let me get to what i want to do. The so called hacker go in and when he was in downloaded the files he need with Firefox "leaving the download history behind" & also no cleaning the history of Firefox. So he login into his Gmail & yahoo account but he did not leave his passwords saved. Would there be anyway to get his passwords?