Personally, I don't judge others that I do not know but from the sounds of it, I do not see how your friend could have done anything wrong if he was making only 18 cents a month.
What worries me is this: It seems to me that anyone could hijack your account simply by the "view source" of your pages. When you 'view source' on a page with your Adsense ads on it, it shows your publishers id number, etc. Now, someone else would not really be making money through your account but if they wanted to get you banned for any number of malicious reasons, all they would have to do is copy your code into some spammy type sites, click on it many times and get you banned.
This is what it sounds like may have happened to your friend or at least it's a possibility anyway. If your friend removed all the AdSense code from his site, yet his site was still getting impressions and clicks, then either someone hijacked his AdSense code or people are viewing a cached version of his website from before he removed the ads.