I actually thought you would be right. But...
I just went back into my account to verify the -777 version I am taking and my MP account has been wiped out of 120,000 miles!!! That is 60,000 for me and 60,000 for my friend!!!
We know the ticket was issued under his account, because all his data came up, name, address, email. He got an email on the purchase, I didn't. After the purchase I did not log out; I did not leave the web site. I went to "My Itineraries", pulled up his new one, went down and put in the upgrade request. His name was always showing on the left edge identifying the log in account.
I have also looked into my friend's account and the mile balance hasn't been touched.
Now I gotta deal with this tonight.....