I think the claim is somewhat ridiculous, both from a technical and juristical perspective, and I would be very surprised if they could successfully enforce their claim. Or, given the possible implications, if they even tried (they're probably only bluffing).
Insofar, I would politely tell them to go away, and forget about the whole thing.
What are the facts?
There is the allegation of your friend having shared his password with someone, more or less out of the blue. The allegation bases on some very questinonable numbers that are (presumably covertly? did your friend know about this before they accused him?) recorded using some kind of unspecified and presumably unreliable system.
Your friend testifies that he did not share his account info, and strong circumstantial evidence (all logins come from his home computer or his work computer, and from times when he worked) confirms his testimony.
The burden of proof is with the provider insisting that the user broke the terms of service, and unless they have conclusive, hard evidence, any such accusation is at best libel (which is actionable, therefore I doubt they will try to press charges).
Assuming a sufficiently accurate measurement, the presence of a keystroke pattern that matches is an indicator for the same person. The presence of a keystroke pattern that does not match is however an indicator for nothing. It can be shown trivially, live, at any time, that the same person can produce a dozen different typing patterns within a minute or two.
Your modern iPhone has a fingerprint sensor. This is a much more sophisticated biometric authentication mechanism with a much lower error rate, which is much harder to deliberately cheat on (assuming you use the right finger) and yet it regularly fails -- on my phone, about once in maybe 10 attempts.
Now, following the logic of this web application's provider, Apple should call the police because I stole my iPhone -- about twice per day! There is conclusive evidence after all... the fingerprint didn't match, so clearly I'm not the legitimate owner. This is ridiculous.
Depending on where you live, the mere covert recording of keystrokes may mean serious trouble for the provider already (they had better not be based in the US).
GetMessageTime() right after receiving
WM_KEYUP is pretty much the most accurate way of getting the message time (you could use QPC, but to what avail... the accuracy is limited by the message, which already contains a timestamp, a higher resolution timer would only give more digits, but not more precision).
If I do this in a simple 10-line program which does nothing but print out the message time while typing "the quick brown fox jumps", and take deltas, then I get as a result that my dwell time is 2 ticks +/- 1 tick, and my flight time is 3 ticks +/- 1 tick (expressed in units of 15.6ms).
Unless your password has a couple of thousand characters, this is way too imprecise to tell anything. A dozen keystrokes, each taking 2 or 3 ticks? Excuse me? For hard, conclusive evidence? You could as well read tea leaves.