XP security

The boss, yes him again, has bought a stand alone lap top for home and office use, with windows XP and quite often will log on to the internet with IE and walk away and leave it unattended. Is he mad? Is there a security risk to his system, will hackers find his information and be able to black mail him?? or leave nasties on his system, or mail him junk?