Breathe: his work is almost certainly fine. A force push only moved the pointer on GitHub. His laptop still has his commits in his local main.
When he wakes up, he does this (and he should NOT run a plain git pull first):
git fetch origin
git branch backup-before-rescue # safety copy of his local main
git log --oneline origin/main..main # should list his 5 commits
git pull --rebase origin main # replays his commits on top of yours
git pushHe might get a conflict or two during the rebase, that's normal.
Then prevent it: in GitHub, Settings → Branches → add a rule for main and leave "Allow force pushes" off. After that a force push to main just fails, whatever tool runs it. And if you ever do need to force, --force-with-lease refuses when the remote has commits you haven't seen, which is exactly what went wrong here.