A 26-char string (with numbers and letters) is too short to be a private key.
It might be an address. He should at least tell you the char(s) it starts with (e.g. 1, 3, K, L, xpriv, .. ).
But based on this fact:
He has finally unearthed the “code” he received on purchase by rooting around old drives etc.
I doubt it is what he is looking for.
You don't receive any 'codes', strings, etc.. when purchasing bitcoins.
The general procedure is the following: You create a wallet -> You buy BTC on an exchange -> You send these BTC to your address (created by yourself).
So, in case he has bought BTC and got an address/private key instead of an actual transaction to his self-generated address, it most probably was a scam.