As this was cash I assume it was booked on your Exec Club account?
You would have logged in to the special landing page using your friend's Hotline - to access the discount - but then into your own Exec Club, with a password you haven't shared with your friend.
If so I don't see how they could access the booking to cancel it, they merely provided the access to the discounted booking engine, the same as happens in many other websites where you need a special link to access discounted rates etc
I may be wrong but a close friend works for BA so I'm au fait with the Hotline booking process.