Give your friend these links to read
as they need to re-secure their Steam account.
I also recommend reading my post here:
As for Backpack.tf report, your friend would need to make their own report with screenshots
but (my personal opinion) this doesn't do much as these scammers use disposable accounts anyway.