You don't. And, the next time you see your friend, chew him out for violating basic Linux/Unix security. I'd originally followed the above with instructions on how to create a shell script in his home directory that would log him out when he tried to change directories as an object lesson, but better sense prevailed. All I will say is that if you understand what you've been told above you can probably figure it out for yourself. If not, it's probably better that way, and I'm not going to put something here that could be used maliciously.
(Mind you, I'd have no hesitation doing it myself, but then, I'm a BOFH in good standing and know what I'm doing. I'm not putting instructions on how to do it on an open forum like this where some skript kiddie wannabe might see it...)
Registered Linux user #470359 and permanently recovered BOFH.
Any advice in this post is worth exactly what you paid for it.