In reply to TimB:
What The Lemming said. Install win7.
If you MUST go with win8, though god knows why that would be the case, then yes you should be using MSE for antivi (don't pay for antivirus) and you shouldn't be using IE after you've used it to download a decent browser (I'd use Firefox). For PDF's I'd suggest foxit reader. Don't go with Adobe, it's slow and clunky as hell and since everyone uses it it's as much targeted for vulnerabilities and exploits as IE is.
If you go with win7 disable updates, they are neither use nor ornament and whoever is using the machine won't install them anyway.
Edit: Also, if the user values privacy in the slightest, get them off that ISP email and onto any of the dozens of better options.
Post edited at 10:56