Please provide the info below to your friend.
This system is put in place to protect you from people trying to log in from other locations. It detects a change in your access pattern (there are several factors including IP) and will lock the account and send an email. To get back in you need to reset your password using your secret question. This is working as intended. The system SHOULD learn your usual login patterns and accommodate them. For example I can log in from home and work and have no issues once it learned my patterns.
Why would it happen to you?
1. You logged in from a new location (the obvious answer)
2. You are using software that changes your IP. People do this to lower their ping and latency but it can trigger the lockout system.
3. You are playing somewhere with a very dynamic IP
4. A hacker is trying to get into your account but does not have access to your email/secret question so can't get in.
5. You logged in from a different PC
If you are unable to remember your secret question or get stuck in a lockout loop then you will have to contact Billing and Account Support https://us.battle.net/support/en/ticket/submit
Select D3 > I can't log in > My account is locked and I want to unlock it. From there you should try the password reset link one more time. If that fails, you should use the option at the bottom to submit a ticket.
In the future, you may want to consider putting an Authenticator on the account. While it does not stop all lockouts, it greatly reduces the sensitivity of the login security system so it happens less often. SMS Protect (not an Authenticator) is also useful because it will let you unlock the account with a code instead of the secret question.https://us.battle.net/support/en/article/battlenet-sms-protecthttps://us.battle.net/support/en/article/battle-net-authenticator-faq