If Lawyer "L" has shown your friend convincing (to your friend) evidence that a computer from his IP address or a computer nominally owned by him or under his control did indeed hack the client site and posted stolen passwords on forums, even though your friend "F" claims "it wasn't me", but your friend F is convinced the forensic evidence is legitimate and he has some criminal or financial liability exposure, I think the deal, although questionable, may be "legal" if the goal is to ferret out other wrongdoers.
I'd ask the lawyer "L" to (1) make sure other unknown "John Doe" defendants are identified in the litigation who may be responsible pending further discovery with the ISP data, and (2) that L executes a side agreement to release him from any liability or claims from L for monetary damages.
This is totally off the top of my head here, however, and a dicey proposition as I'm sure you recognize (which is why you asked). I'd also have F get his own attorney to do more research into the full facts and legality of this transaction and any ethical concerns and to negotiate the terms of this transaction with L and make sure he's not exposed either for the damage to the client site, criminal charges or participating in frivolous litigation or fraud.
Take this free advice for what it is. Free advice that could be way off the mark on further investigation. Note disclaimer below! Other attorneys, please feel free to chime in with your thoughts....
This answer is provided under the Avvo.com “Terms and Conditions of Use” (“ToU”), particularly ¶9 which states that any information provided is not intended as legal advice or to create an attorney-client relationship between you and me or any other attorney. Such information is intended for general informational purposes only and should be used only as a starting point for addressing your legal issues. In particular, my answers and those of others are not a substitute for an in-person or telephone consultation with an attorney licensed to practice in your jurisdiction about your specific legal issue, and you should not rely solely upon Legal Information you obtain from this website or other resources which may be linked to an answer for informational purposes. You understand that questions and answers or other postings to the Site are not confidential and are not subject to attorney-client privilege. The full Avvo ToU are set forth at http://www.avvo.com/support/terms . In addition, while similar legal principles often apply in many states, I am only licensed to practice in the State of New York and Federal Courts. Any general information I provide about non-New York laws should be checked with an attorney licensed to practice in your State. Lastly, New York State Court rules (22 NYCRR Part 1200, Rule 7.1) also require me to inform you that my answers and attorney profile posted on the Avvo.com site may be considered "attorney advertising" and that "prior results do not guarantee a similar outcome".