Sounds like your friend ran into a bug. I don't see a reason to assume malicious intent unless Microsoft refuses to fix this issue.