There are multiple 'tells' your friend might pick up on if he is a victim of a mitm vector.
Is your friends connection slower then usual?
Is the facebook page exactly like the one he sees at work, school, etc?(compare source)
Ettercap has a few modes designed to detect a mitm attack that your friend can make use of.
None of the above methods are fool proof, but together they build a picture of possible side effects.
Your friend can bypass a dns_spoof by navigating to facebook by its ip (18.104.22.168) and us a vpn tunnel (tor is free but slow)
Having said all this, it is unlikely that your friend is a victim to a mitm attack. It is extremely probable their machine is infected with keyloggers.
Have your friend run a virus scan, clean them out and then check all facebook security settings.
Also, if your friend uses yahoo have them switch to gmail.