If you know the time and date of the intrusion pretty accurately, you *might* be able to figure out what the IP of the person who visited the site is, but that’s assuming you get almost no traffic. Once you have the IP, you have to get the person using the IP. Ask the RIAA how easy that is. ISPs are incredibly reticent to give out any details of users using specific IP addresses. IIRC, at this point they need a warrant. The best advice I can give you is to have your friend change the password to something 8 characters or longer that has at least one number and symbol like &, @ or $ in it. Depending on how paranoid your friend is and how much of a geek the suspect is, you might want to reformat to avoid keyloggers planted by this friend.
One of my coworkers had something like this happen and had to reformat due to the fact that her ex was the one who set up her home computer. He was a sysadmin and set up a keylogger on her system to find out her email passwords. Needless to say, he was kind of a freek. Even by my standards.
