http://us.blizzard.com/support/article.xml?locale=en_US&articleId=20558
- Transfers between accounts can be done only if you are the registered user on both accounts. (We do not support the transfer of characters between friends, guild mates, or family members.)
They have this system to prevent Account Selling, a market that is very similar to Gold Selling. Often times power levelers will spend a week powering up an account, throw on some gold, and then sell it for $100-500 depending on how much gear they decide to add to the character. Since such a practice is frowned on, they made it policy that if they find an account changed hands, they will close it.
The only way for your friend to get around this issue would be to always buy pre-paid cards and keep your name on the account, since Blizzard would be unable to prove that you gave the account away. Since you are getting a message saying they are closing the account, he mostly likely attached his credit card to it, which is basically like throwing the account away. They are going to notice when a billing record changes from Dave to Charles, or whatever your friends name may be.
Now, that is if any of this actually happened and the e-mail is genuine. Like mentioned above, some spam e-mails circulate that talk about closing your account and act like they are from Blizzard, tricking you to "login" at the link in the e-mail, to stop the "closure". These websites are phishing websites (
www.worldofwarkraft.com,
www.wowblizz.com, etc), and the minute you go to the website and put in your account name (in a webpage designed specifically to mimic the exact look of the real website), it's beamed to a database where some guy is already logging onto your account, changing your password, selling all your gear and mailing it between dozens of other hacked characters till it reaches a master character used for selling (often times, ANOTHER hacked character), before using your account for advertising purposes by creating level 1 alts on other servers to spam "BUY GOLD CHEAP" ads. If they are really nasty they also attach an authenticator to the account, making it harder for you to get the account back.
This is why I personally have my own authenticator, even though I would never fall for such tricks, I would rather be safe then sorry.