If he's running a honeypot, that's like telling the hacker "here I am" over and over again. That would probably explain why he's always being targeted.
So you're saying you've never seen this before and that you've only seen it now after you were threaten? Im not trying to question your intelligence or anything but sometime people can get so paranoid and dont realize that this type of stuff was happening on their machine alone time before they even know about it.