The 60 day rule applies to transactions that occur AFTER the 60 period expires; it does not apply to transactions that occurred before then.
The $500 liability rule applies to transactions that occur more than 2 business days after he becomes aware of the loss or theft of his access device (if he doesn't inform the bank before then). The fact that he might have known about these charges on 5/3 when he reported them is not relevant to the Reg. E timeline rules. On the other hand, it might be evidence that at least at that time he did not consider the charges to be unauthorized.
Also, you mention that it was his ex-wife or girlfriend that initiated the charges for the utility bill. Was this a bill that he was obligated to pay anyway? If so, it's not unauthorized for Reg. E purposes because he benefited from the charge (it paid an obligation that he owed).
At some point, if these are utility bill-sized charges, you have to ask yourself it is worth all the time and effort to track these facts down instead of just making the reimbursement.
_________________________
Nobody's perfect, not even a perfect stranger.