He acquired his iPhone second hand from someone other than Apple or an authorized Apple reseller. He must not have known that before you acquires an iPhone, iPad, or iPod touch from someone other than one of these sellers, you need make sure that the device is erased and no longer linked to the previous owner’s account.
What this means to him is that there is no way we can help him. We are not authorized to remove the activation lock from any device. whether it now is present or will be present if erased and not signed out of iCloud first. And, under his circumstances, Apple will not help him since he cannot provide proof of ownership that Apple will consider to be sufficient (i.e., his purchase receipt for the phone with its serial number on it).
All I can suggest is that he try to recovery the needed password from is ex colleague. Recovering this password or answering the related security questions satisfactorily is the only way the phone can be made functional for his use.