Before pursuing this, the OP might want to consider whether the friend was a registered guest in the hotel versus just visiting, and if visiting, whether there was any unauthorized use of facilities such as lounge, pool, etc. Was the massage cert transferrable? If pushed, the hotel could examine the circumstances of the friend's visit and use of spa facilities.