Q:
Accout got hacked
A:
If it’s been longer then 3 days, you should post the ticket number in the thread below.
https://forum-en.gw2archive.eu/forum/support/account/Tickets-for-Review-3-days-and-older-merged
Also, I would have your friend change the password on his email account as it may have been compromised.