Decentralized exchanges work with smart contracts, so I do not think it is possible. Maybe friend´s metamask was hijacked? Or he has in the computer a spyware?
I experienced it too, I never use Idex before but 2 months ago I used it for the first time because the token that I was holding listed there. Just like OP, I used my own wallet and integrate it with them. I did not logout because I thought everything will be fine, but 2 weeks after I am using it. All of my balance and tokens were moved out,
so I think everything is possible, they might not do it openly but the chance for them to do it is high too.