The most likely explanation given this layman's description is that the “mail from the good friend” contained a link to a site that exploited a bug in his browser to install some malware.
If this is not a targeted attack, there's a good chance that the malware is a well-known one that standard anti-virus software can find and clean up. The malware may have then either read your friend's address book locally, or piggy-backed onto a connection to the mail server to read his address book there. If you're not too paranoid and you manage to identify the malware, perform the clean-up. If the malware is known to collect passwords, check all passwords and accounts that may have been breached, as Iszi explains.
If this may be a targeted attack (likely if Mr Doe is a bank manager or political activist, not very likely for some random Mr Doe), then you can't make any assumptions. Even if an antivirus finds a malware it recognizes, this could be a non-standard malware masquerading as a well-known one (but then why would it announce its presence at all?).
The fact that the malware was on a company that's related to Mr Doe isn't necessarily an indication of a targeted attack. It could simply be the malware's way of spreading, trying to reach people through channels they're more likely to trust.
Check the site of the company where you think the malware is coming from. (Don't use a vulnerable browser, of course, or only in a VM with restricted connectivity.) If you find a suspicious page, do report it.
There's not much the webmail provider can do, except let Mr Doe reset his password. It's unlikely that the webmail's security was at fault − the compromise happened on the client machine.
Another thing you don't mention is to check where the mail with the link came from. If it did come from the good friend, then the good friend's also been infected with the malware. Don't expect Mr Doe to be able to tell a spoofed email or even to understand the concept.
To prevent recurrence, at a minimum, install an up-to-date anti-virus (assuming Mr Doe is running Windows), and use an up-to-date version of Firefox or Chrome to browse the web.