My friend caught a trojan that did this everytime she logged into facebook. It might not even have been your friends email addy, my sister had a virus which sent itself out using email addresses from her address book. It's a good idea to email him and suggest he runs a virus check.