They said that my friend could get it back after a little while using the standard recovery options. He doesn't have access to the recovery emails or phone number, so he opted to enter information about the account. When he does that, he gets an email saying that recovery is not possible with that method because 2-step authentication is enabled. He never enabled 2-step auth, so maybe it was enabled by the person who accessed his account.

What can he do to get access to his account again?

Thanks.