I would suggest two possibilities, in addition to those already mentioned.
First one: there could be a serious problem here, completely not scam related. If your friend has ever done business with the company in question, he may have given his email address as the email to use for that business. All fine so far. But now the company is sending things to it, for no obvious reason. That screams the possibility of their database having been corrupted.
Corrupted at the minimum to the point that emails in it are no longer valid. That some emails are now linked to customers they were never part of, and their own emails are no longer linked to anything. Or are corrupted to be linked to a third customer. So... "orphaned" or "living with the wrong family."
If so, one must wonder what else got corrupted. Was it just email address links? Relational databases can be complex, very fine-grained, so quite possibly, even if some untoward event whacked the database. But it could be far broader. The records could have a LOT of jumbling and your friend's information could be going out into the world for unfortunate effect. Or even if so, it might not matter much, to him or anyone. Especially if he does not current business with the company. So even if the "unfortunate events" involved hacking and stealing data or just damaging it for fun or profit, he may not care.
Second one: I can surely see how a company, or fraudster, could use the approach for a scam.
We've all gotten the kind of email mentioned elsewhere, the "You have successfully paid $1,232.04 for your new iPhone ... blah blah ... If you think there was an error in the payment or the transaction is not yours, click the button above to have it removed" kind. Easily recognized as fraud and one would never click the button. (Sadly, many DO click "in" the email, on whitespace, to further investigate things, see links, and so on, only to find the whole thing, whitespace and all, is "the real button" and they've already activated the HTML file that will begin the hosing. Peeps need to move such to Junk Mail and then look at it, or forgo the learning process altogether. After all, one can lead a rich life never examining a violent mugging-gone-bad by being the victim.)
So, those must have a very low rate of pay for scammers. And this matters because those scum often work as long and hard at it as a human being does at a real job. I listened to a fellow in Hungary once complaining about how little he makes for averaging six hours a day after his day job. It's a grind and like anyone with a brain, they want more for any given amount of work. So how to raise the number of clicks on "the button"? One way would be to engage the person BEFORE his brain sees the fraud and runs down that path. What if one got the brain to see the "oh no, someone's facing unhappiness for this and all I have to do to help out is click here, write a couple sentences, and all will be better and I'll have been a good boy!"... and his brain heads down that path, never to examine the fraud thought again. (Or, once in a while, like your friend, maybe he does. But maybe long after he "was a good boy.")
And so the click. Whether this installs the encryption and monitoring software that lets the scum really encrypt your storage and monitor your camera and the porn sites, er-r-r, websites you visit and what you are doing whilst at them, or just leads to a (probably pretty apparently fraud related) place to let them know they mixed up their emails and whatever (maybe scammy) future that leads to... Or simply leads to a website where you might end up looking about "as long as you're there" or maybe because now that they have you there, they tell you you can have a "15% discount on any purchase today" as a reward for your helpfulness (not as "compensation" for it as that generates a very different "mouthfeel" (as chef's often say) when reading it).
Even the last is actually scammy because they were just using the fake, though real-looking mishap, to generate "foot traffic" on the site for sales, or even as a middleman being paid to generate clicks to the site. Consider that I do this. I send you one of the emails that goes on about errors on your website and you curse at me, then delete it. I send you a few more, as different people. All deleted. So I change up my campaign. I send SEO emails: "I can help you, and you don't pay unless I generate clicks!" What you assume is I do something in some magical way like Google might. In truth, I set up this scam to get folks to MY website, then they read how helpful they were, what good people they are, and about the 15% discount (which you have authorized me to offer folks... after all, you offer 15% yourself all the time for the same reason, a first sale to someone). My page is set up to look like yours: I just go to the appropriate-looking place, save your page, then regenerate it as input to my site, and my hacking software pulls all the logos and format, but inserts the necessary text to make it look like you were a good boy (remember, my customer knows nothing of this happening, I'm faking a web page to just look like it's one of theirs), and when you click to go search their products, it really takes you there to do so. So I have filled my bargain with them, generated a real click by someone with a discount they will honor... but in about the scummiest way one might do so.
Might've tried a few other things with your click to go search products, but I might not want their effects (maybe window pop up and you kill the whole browser instance instantly) to lose my click-fee. Of course, in a year or two (or ten as this is a low impact fraud and might take long to be recognized and joked about enough to become widely known) when the scam doesn't generate much... signing up websites is hard to achieve... I might still do it without click-fee customers, but rather whatever I can pack in, maybe some of that encrypt and monitor software, maybe just 200 pop ups, maybe install a couple ad-blockers on you and collect fees from those scum. But for now, maybe it's sort of honest in the sense of while the way I got you there is utterly unethical and scummy, you make a real decision to buy, o not, something due to the 15% discount (and the bump up in things like cortisol ad endorphins I achieved with my fraudulent "I'm a good boy!" scam pushing you further than your original mental state would have).
And of course, to paraphrase (a lot, really a lot) Clifford Irving when he pointed out to the Guinness Book of World Records that his number one fraudster of all time (having specified a list of tenth to second already) was "Mr. X" who by definition got cleanly away with his fraud, there could be a hundred or a thousand other scams I simply can't or haven't thought of that are the real case.
Or none at all. (See, for one way of such, the first thought presented.)
