there was the lodestone notice put out about the square enix account system being hammered by brute force password attacks. sounds like your friend fell victim to that.

also, no support team worth their salt is ever going to accept reports from a 3rd party, even if it's done in good intentions. their response of getting the person affected to take action was the correct one.