First off, You want to be absolutley sure that he was hacked. And if he was hacked, you need proof to show Microsoft. If you can get the hackers Gamertag, i would give that to Microsoft so that they can track what he does. If Microsoft do find details that the account was hacked, and can make sure it was not your Brother who bought the MSP and Membership, i would imagine that Microsoft would refund him.
But i think they would ban the Hyjacked Account anyway, so a new one would have to be made. Just what i think.