sounds like they went trough the API this would allow them to mess up the transaction fees.. the only transaction fee you can choose is a tick box of 0.005 so its either a server exploit of API exploit both of which could or couldnt be your friends fault but should be serious concern to mtgox..
This - website does not allow you to change the amount of the trading fee. You've had your key and secret stolen somehow from your local machine. 2FA will not help in this instance unfortunatley.