Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.
The biggest cards won't fit but fairly huge ones will.
If he has to buy new and $200 is a hard limit then yes one of the 3GB cheaper 1060's is the best he can do right now. If he doesn't mind buying used and stretching his PSU a bit 970's can be had for $200-ish on ebay right now. They use around 150-180W.
Too bad he doesn't have a 550W or 600W PSU. Used 290's are going for $180-ish right now.