Your not supposed to allow members to reuse an email address.
Someone could have gotten your friends email password - this could have been done through a keyword logger. Or he checked his email from an infected computer.
It does not sound like a "hack" at all, but more of a combination of low security settings on your forum and your friends computer.
Yeah, I've since set the radio button over to not allow same email addys