keylogger in media file?

[mosta]

my friend seems to have had his gmail account hacked. he couldn't log in (until he got help from a friend at google to reset). he's positive he hasn't changed his password or told any person ever.

I'm slightly tech savvy. I told him that as I see it either he was key-logged, or he got hacked. his password was pretty weak but not quite trivial: the name of a country plus two digits on the end. being hacked seems unlikely because I assume that google would protect against thousands of log in attempts, and why would someone bother hacking a gmail account?

so I figure he must have gotten key logged. but he (being very tech shy) says the only things he has downloaded since he got his new computer are itunes, firefox (and extensions on the site), and a few media files (music and image and video, some of it undoubtedly porn).

my question is if he only downloaded (suspect) media, could a key logger be in there?