Hi,
You need to contact Steam Support (link provided above)
https://support.steampowered.com/
Make a support account and send in a message about the account being 'hacked', include the username of the account (not the community one, the login one) and any other information that will help your 'case'.
Steam Support are known for being pretty bad so expect to wait up to 4 weeks for a response, if it helps. I was hacked too (did something stupid, too long to discuss) and I contacted the Steam Support, they took about a month to respond but got me my account back! 😀
Hope you friend can get his account back!