Warning Sons cards and inventory items being sold without his permission

won't listings be cancelled after 6 month (or was it 1 year), or maybe it's difference for old stuff (like some items have listing where you can choose from who you buy)

Remember this exists https://help.steampowered.com/en/accountdata/SteamLoginHistory .You can use this to check for logins outside of your country.

Best to follow these steps as quickly as possible. The next stage in this type of scam has the scammer controlling your son's account steal all the wallet credit by purchasing some overpriced item they've listed on the marketplace.

^^^^ he should get an email every time an item is sold. if not somebody changed his steam linked email

And these links is how your son got into this. He clicked on one, logged into that fake site and voila :(

He should follow the steps that a user above posted 12 hours ago. It isn't so much work or so complicated as it looks.
After this he only need to verify that he is the real owner, as example with the proof of paying for game XYZ (credit card infos, steam emails or such stuff).

He shouldn't "close it for good", aspecial when it is in the hand of phishers/scammers because they will harm other ones from his over 500 friends and additional users because they would use the account as long as possible and because the account looks legit and not like a bot/side account they will be, very, successful with it.
In the end they could sell the account and/or play the game for their own entertainment.
I am sure nothing of this things are something that he want grant the phishers/scammers/hackers.