I am sorry for your friend's loss. 450 btc is a lot of money. Why did he stored so much in a web wallet? Spend a fraction of his savings in a hardware wallet would have prevented this.
A company (merchant), not a friend, and this was Jan 2014 so pre hardware wallets. That said, the security was poor and I suspect compromised machines in any case - a browser plug in for Bitcoin trading was in use. Either way, the thief has decided to move the money about this evening...
There are many scam attempts have happened by the Blockchain, coinbase even paypal too. I do not understand the bitcoin wallet without the dat file or private key. That cannot be done.
Once in 2015, I just Googled the blockchain wallet and trying to login with the site to transfer 0.06 btc for one trade but amount in my wallet was hack or theft. Hence, I understood that I passed the ad link which similar to the site's URL.