sometimes keyloggers post up their links on WoW official forums. so careful what he downloads.

unless he's using a hack?

although blizz is using a screening program that follows certain patterns. if your friend has been transfering gold between chars or friends, that might trigger the investigation. a lot of ppl are getting it.

he has to contact blizz but remain polite about it. if need to be firm, be firm but not rude and no leetz speak. else they don't believe u.

http://www.blizzard.com/support/wowbilling/?id=abl01922p

hacked accounts are handled by Billing side, not Technical support.

nope. no problem if using TS and ventrilo.

sometimes, it's just a weak password. just bruteforce their way through. or addons.

best thing your friend can do is reformat his hdd and reinstall.