So my question is what further steps can he take to help himself get unbanned and has this happened to anyone else?
A real bummer.
That would mean your friend got hacked in some other way, probably a man-in-the-middle attack where the hacker somehow intercepts the authenticator code.
If it's not hacking at all, there is talk about item duping / buying duped items / strange AH activity / 3rd party scripting getting players banned. Not really sure about what's going with these things.
Threats of violence. We take these seriously and will alert the proper authorities.
Posts containing personal information about other players. This includes physical addresses, e-mail addresses, phone numbers, and inappropriate photos and/or videos.
Harassing or discriminatory language. This will not be tolerated.