I noticed a new member has joined the site tonight...with the original member's email address.
Your not supposed to allow members to reuse an email address.
Someone could have gotten your friends email password - this could have been done through a keyword logger. Or he checked his email from an infected computer.
It does not sound like a "hack" at all, but more of a combination of low security settings on your forum and your friends computer.