If your friend received that address from "his IR exchange in Australia", one would think it would be one of their addresses.  It doesn't make any sense that IR would be providing anyone an address for a different service such as Kraken.  If so, have you contacted IR support to see if it is one of their own addresses?   Of course, if he didn't really "receive it" from "his IR exchange" and instead used an address that he had previously sent bitcoin to from IR in error he would probably know who that was based on his transaction history at IR who that address belonged to.

As DannyHamilton said above, something got messed up in one of the listed steps. It seems prudent to verify that the address "1NxR3TLr1AXYYodX7EC2PVYqWL1XuQcC8m" actually was provided by IR *or* whether it was something your friend had sent to previously, *or* if that address was changed by malware on either of your machines.  

If it was provided by IR, why are they providing addresses for different services?