Decentralized exchanges work with smart contracts, so I do not think it is possible. Maybe friend´s metamask was hijacked? Or he has in the computer a spyware?