sounds like they went trough the API this would allow them to mess up the transaction fees.. the only transaction fee you can choose is a tick box of 0.005 so its either a server exploit of API exploit both of which could or couldnt be your friends fault but should be serious concern to mtgox..