I've never heard of funds leaving wallets automatically and a matter of fact there is no such thing ,someone you trust or very close to you have access to your private key ,don't use the wallet anymore and if you have any fund left in there move it out to new wallet
Moving it out is now the issue, because according to his statement, when he tries transferring it using different address, the address he intend transferring it to keeps changing to another one, so this is not about his friend or relative doing this, a spamming tool has just successfully act into his account and probably controlling the account either directly or using the spam software on his account to do so.
The best would be for him to either format such wallet, change is private keys to a stronger one and finally apply some wallet extra security measure and see if the problem will be solver, otherwise, he may just have to will that account to the hacker.