Ask your friend to use another casino.
So far Bitstarz has a good record.
I don't think Bitstarz will cashout his Bitcoin Penguin wins
I've actually heard good things about BitcoinPenguin in general, but any casino that promotes their "anonymous casino with anonymous registration" and then has a rule like the following should make players think twice:
Any attempt to create multiple accounts, fake social media accounts, emails, or any other attempt to claim multiple bonuses that are only meant to be claimed once per person, IP, and household, will lead to an investigation and possible account termination without notice.
I suggest sending support an email with a link to this thread. Then tell them that tomorrow you'll be warning others on Twitter, facebook, casinomeister, latestcasinobonuses.com , casinolistings.com, askgamblers.com, thepogg.com and whatever other forum you can find. Then do it.