Long story short; don't know how he got acces. e-mail was dutch (had minecraft and nl in it) What I find suspicious is that I host the VPS with a dutch company who mainly focus on minecraft.
Can't assure that though. I know the guys email and can probably get IP if I wanted to (just see who made connection to the vps)