Your best bet for finding out exactly what's going on is to turn debugging on (/debug on) and have him "op himself" again (if he will and is not malicious as you say). Then look at the debug.log and try to make sense of what happened. If it is something with a script, you will more likely than not see a message sent to you that you didn't see in the regular output. If it's actually you doing the opping, you will see in the debug.log a command sent from you to the server to op the person.
Good luck.
