If the word SPAM is being added to the subject, then it is probably being added by your ISP. To check it out, have your friend send the same email to different accounts.
ISPs will determine if some web addresses (such as @msn.com or others) is a common source of spam and label it as such or ban some originators. This is done at the post office level, not your Mail program. It could be that joe@msn.com has been identified as a spam source.
Further, if your friend left their email account's default password in place, spammers could have gained access to his email account without his knowledge and are using it to enter his account and send out spam without having to hack anything. There is no way for a user to tell if someone is using an account to send spam.
There may be other things that can trigger the SPAM addendum. I am not sure if suspicious links in signatures or references to drugs or medication can be detected, but it seems that they are. I get at least four kinds of addendums, -- SPAM --, -- spam --, Possible Spam, and SUSPECTED SPAM(in brackets). Depends on the brand and rev level of the mail servers spam detection software.
Message was edited by: Mr Alexander