Domain is not his usual email address. Has his correct name and my correct address of course, has a link that loads a fake forbes website with a smart pill advertisement. I let him know via facebook that I doubt he has this additional email address. Does this mean his account is hacked since my correct email address has been used? He isn't in Japan, but in the UK. Gmail put it in my spam folder.
His account might have been hacked, but not necessarily. The email is likely spoofed, and account access is not required to create a spoofed email.
Plausible ways this can happen:
- An email is CC'd to a large number of recipients, which includes both you and your friend. Out of that list, one recipient's account is compromised. The attacker (or an automated bot written by the attacker) sees the recipient list of that message and spoofs a message from one person (your friend) to the rest.
- Someone who has both you and your friend as contacts is victim of an account compromise. The attacker (or automated bot) sees both you and your friend in the contacts and decides to spoof a message from your friend to you.
So there's a good chance someone's account was compromised, but it may not have been your friend's. That someone might only be distantly linked to both of you.
Tell your friend to change his password and security questions anyway, but it's not reason to panic unless there's evidence that his account specifically was compromised.