This does not address the risk identified by bobcaststephen. It goes without saying that she should cancel the upgrade and that her friend should deal with eBay regarding the sale of the GUC.

But, failing to come fully clean to UA may mean that UA not only cancels the UG, but the underlying ticket as well. No idea whether closing her MP account is in the cards.

Your friend will likely be asked to identify the person who purchased the item on eBay and that person will also likely hear from UA.