He's only going to jail if...
A)He left evidence (real ip or didn't use a proxy while gaining access)
B)He bragged and it points back to him
C)He has any proof of the incident on his computer
If he did do that,then expect a knock on the front door.
Besides,the police only care if you steal data files or attack systems,1 account shouldn't put him behind bars,it's not like he killed a server or anything.
Besides,a hacker nowadays is someone who "hacks" their system to make it function better than it normally would. What your brother "did" is cracking.