As described, setting aside the initial spoof email that perhaps started the chain of events, the source of later emails purporting to originate from your from your friends email account is very unlikely to originate from the iPad. I’ll explain more in a moment.
It is possible that your friend’s email address book has been somehow been harvested from a PC or other computer - or perhaps your friend’s email address has been harvested from someone else’s address book. The manner in which this has occurred can only be surmised without more detailed analysis of emails sent and received - but it is perhaps likely to be some form of malware running on the victims computer that has extracted various email addresses.
A common mechanism to get malicious email to a victim (in this case, your friend’s friends, who have seemingly received email from your friend) is to send email with a spoofed sender’s address (your friend) to the intended victim (your friend’s friends). They will perhaps open these email messages because they come from a “trusted” source; malware that may be included in the email then has opportunity to attack the victim’s computer.
Returning to the iPad…
Due to the system architecture of iOS/iPadOS, unless jailbroken, an iPad is not susceptible to traditional malware infection per-se. However, as with all computer systems, there are still vulnerabilities and exploits to which you remain vulnerable.
While an iOS/iPadOS device is unlikely to be directly infected by malware, it is still possible to easily download an “infected” file to the iPad - which if transferred elsewhere still has the capacity to infect other computer systems with malware.
There are no bona-fide anti-malware products for iOS/iPadOS. Again, due to the “sandbox” system architecture, products of this type are ineffective - as anti-malware products cannot “scan” any memory outside of their own protected area of memory (their own sandbox).
A useful degree of protection can however be added to iPad/iPhone. Methods to mitigate against exposure to malware and other threats are limited - the most effective being (a) use of a good Content/Ad-blocking product - and (b) in using a security-focussed DNS service in preference to automatic settings. Combined, a significant proportion of malicious content can be stopped before reaching the iPad - but this alone cannot prevent email addressed to a recipient from reaching their inbox; email requires vigilance in identifying potentially “bad” email.
One of the very best and most respected Content Blocker Apps within the Apple App Store - designed for iPad, iPhone and Mac - is 1Blocker for Safari.
https://apps.apple.com/gb/app/1blocker-for-safari/id1365531024
1Blocker is highly configurable - and crucially does not rely upon an external proxy-service of dubious provenance. All processing takes place on your device - and contrary to expectations, Safari will run faster and more efficiently.
Unwanted content is not simply filtered after download (a technique used by basic/inferior products), but instead undesirable embedded content blocked form download. A further benefit on metered services, such as cellular connections where you data may be capped or chargeable, this not only improves speed but also saves you money.
1Blocker has also introduced its new “Firewall” functions - that are explicitly designed to block “trackers”. Being implemented at the network-layer, this additional protection works across all Apps.
For security focussed DNS, I strongly recommend using one of the following services - for which IPv4 and IPv6 server addresses are listed:
Quad9 (highly recommended)
9.9.9.9
149.112.112.112
2620:fe::fe
2620:fe::9
OpenDNS
208.67.222.222
208.67.220.220
2620:0:ccc::2
2620:0:ccd::2
Cloudflare+APNIC
1.1.1.1
1.0.0.1
2606:4700:4700::1111
2606:4700:4700::1001
Use of the above DNS services will help to shield you from “known bad” websites and URLs - and when used alongside 1Blocker, or other Content Blocker provides defense in depth.
There are advanced techniques to further “harden” iOS/iPadOS (such as DoH, DoT and DNSSEC), but these are perhaps beyond the immediate skills of novice users.
I hope this information and insight proves to be helpful.
