It is possible that your friend was victimized by a phishing site, like majority said here. It is like the private key was given away for some reason.
I had almost fell for one back in the old site of MEW.
I joined an airdrop and they emailed me about claiming my tokens then it redirected me to fake MEW site.