Well once your 'friend' contacts support and has them perform an Unauthorized Access Investigation (at which time they will lock the account until it is complete within 7-30 business days). While he is waiting for that to be done
he should take a few moments to read Xbox LIVE Account Security.
Did this solve your problem?
Sorry this didn't help.
Great! Thanks for marking this as the answer.
How satisfied are you with this reply?
Thanks for your feedback, it helps us improve the site.