Your friend should urgently contact Steam Support through the official website (help.steampowered.com). They need to select the option "My account was stolen" and provide as much proof of ownership as possible - for example, old account details, purchase information (card number, screenshots of receipts), or game activation keys. Even if the hacker changed the email, Steam Support can still help restore access. Before doing this, your friend should secure their email account and scan their computer for viruses.

Get your friend to follow this guide:

https://gtm.steamproxy.vip/sharedfiles/filedetails/?id=3456188107

Steam Account Recovery

It is possible to recover a stolen Steam account. You don't need access to the email, phone or password currently tied to the stolen account for this to work.

The recovery process allows you to contact Steam Support to provide proof of ownership.

Follow this guide to recover your account:

https://gtm.steamproxy.vip/sharedfiles/filedetails/?id=3456188107

Support articles about account recovery:

Recovering a Stolen or Hijacked Steam Account

Providing Proof of Ownership

Link from the guide to start the recovery process:

https://help.steampowered.com/en/wizard/HelpWithLoginInfo?accountsearch=1&issueid=408&reset=1