Thanks for the post, I had something very similar happen. He had addresses on a piece of paper, not even QR codes and admitted they were not his. I felt uncomfortable about the whole thing and declined to sell the coins.
Once he admits it's not for him and on behalf of a 3rd party, you would be operating as a money transmitter without a license. They charged Charlie Shrem of Bitinstant for that crime.