OK. I see what you are talking about. There are some Apple services that will return information about your machine if you supply a portion of your serial number. When I run one of those against the serial number in those images, it does return “MacBook Pro (13-inch, Mid 2009)”.
Also, that screenshot says the machine is running 10.9.5. And the window in the screenshot itself is from 10.9.5. The same view in 10.10+ would look significantly different. That machine is running 10.9.5, which would be impossible on a 2009 machine.
It does appear that your friend was scammed. I am curious about how those values were altered. Could you do a little test for me?
I wrote a little diagnostic program that shows some of these internal values. Download EtreCheck from https://www.etrecheck.com and run it. Create a new reply and use the "Notes" tool below to add your EtreCheck report. Using the link above, you can download EtreCheck from the Mac App Store or download EtreCheckPro directly.
Obviously, you will have to run this on the machine in question. I’m just curious about how this scam was accomplished. There is nothing that we can do about this problem, other that recommend that people only buy their Apple products directly from Apple or an Authorized Apple Reseller. Now, we will be able to use your post as additional support.
Disclaimer: EtreCheck is my own app. EtreCheck is free to use but has in-app purchases available. Downloading EtreCheck or using it could give me some form of compensation, financial or otherwise.