The most likely explanation is that one of his devices visited YouTube over HTTP (not HTTPS) and his ISP "helpfully" installed some kind of caching proxy that returned the wrong cookies to the wrong user. ISP have been known to cause mixups like that when cranking up caching aggressiveness to 11.
The ISP might have return his cookie to someone else running iOS. The fact that it only happened for a few hours might be explained by cache expiration.
If ISP's are returning cookies from the wrong users, wouldn't it also be possible for login credentials (stored within cookies) to be returned as well?
Login cookies are usually sent over HTTPS. Check your browser's cookie store, you'll see that Google services use so many of them, also because of the many hostnames and domains they are on. I suspect YouTube cookies because you can't use google.com ones directly on its domain. And the console mentions devices that have been used with the account, not that have been logged in or have attempted to do so (an important distinction), which points again to cookies. If he used Chrome or another browser supporting ChannelID, such a mixup would have no consequence, because Google's GFE would detect the situation and mint new cookies or redirect the user to a login page.
At no point should the ISP know his or any other user's cookies. If youtube is at all set up correctly, login cookies would be marked secure and only sent over https.
