Phishing thing. He clicked a link that compromised his account and started spamming his friends list. He'll need to quickly get his password changed and probably update protection on any other sites that use his same data.
Don't click the link, don't give out your password or anything.