Where did he buy/get ARR? It sounds like either a friend gave him the code (and it was their Steam code that they didn't need) or he bought the key from somewhere and they actually sold a Steam code instead of non-Steam.

Unfortunately finding that out won't help with the problem though as it's not possible to convert a Steam account into a non-Steam account (and vice Versa) so realistically his only options are to try and get a refund for the HW version he has and get the Steam version (trickier if it's not available in his Steam library though, although it might be possible to get one from some of the key selling sites). Or he could buy ARR on Steam (and not use the code they give) to get it into his account to be able to add HW as well. Not ideal though I appreciate.

Sorry not much help, but that's really all he can do. Buying ARR on Steam (just to add it to his library) might be the easiest option long term though because he'll have the same problem with the next expansion whenever that launches (2 more years?)