How to protect email addresses after domain name expires?

Maintain the domain registration indefinitely on behalf of your friend. You could register it for ten years and renew it yearly so the risk is always ten years out, and hope that by the time they stop using it, whatever systems they authenticated with it are also defunct within ten years. You could also retain a company like MarkMonitor, which does domain management as part of trademark and other IP management.

But there's no way to control it after it lapses. It's an implicit risk for any system that relies on email for authentication.