@fribbledom oddly enough, I sort of experienced this in reverse: someone managed to sign up for instagram with my email address, despite my never having confirmed it. later, when I signed up myself and confirmed my email address, it logged me into this other person's pre-existing account.
I had no way to contact them 'cause the only email address on file was my own. I changed the name and and password, deleted all their stuff, and moved on.
@fribbledom (highly unlikely this is the same problem your friend had, but it does suggest there might be problems with their security model.)