Are you sure it was sent through your friend's email servers, or did they just address the From: field as coming from his email address? Check the headers to be sure.