Are you sure these e-mails are actually from BA, or could they be from some scam artist trying to get into the account (in the same way as the scammers do for bank accounts).

If it could be the latter then you should just ignore them or put them on a spam list. If they're spam, then they won't have originated from BA and BA obviously are unable to do anything.

I take it your friend has actually checked with BA that they're not asking him to do this?