In any case, if you want to change anything with your registrar, you have to be persistant. Think "rabid dog". Don't leave them alone until you get what you want.
In your case, so long as xyz.com is currently still your friend's domain, then contact the registrar and they will probably have a process (e.g. a notarized snail-mail letter) to deal with situations in which access to the online control panel is no longer possible.
If xyz.com has been hijacked (pre-expiry) by the new owner of abc.com then it's time to think about going to a lawyer.
Naturally, when you apply to transfer the domain to the new Registrar you will put in an email address that works and goes to you or your friend.
Once the name is transferred, change the NS so it works, and maybe send the guy $10 via Paypal for helping your friend out of a mess.