She may not be able to sue for damages, but she can press charges! It's a crime!
He didn't ask about that.. he asked about whether or not he could sue.
And while you may be right, I sort of doubt the police would really take it too seriously. This is not exactly in the higher ranks of cyber crime. This type of thing happens every single day on WoW, in e-mail accounts, etc. I can think of about a dozen people who had this very thing happen with this game. I'm sorry, but the onus is on a person to an extent to think of a password that is NOT guessable, and if I were him, I would ditch the friend and get the account restored rather than go to the cops with something like this. It's petty, but I'm saying myself as a gamer who has put weeks worth of play into WoW, some people need to realize that it's still just a game. Yes, you can file a report and request the DA press charges, but it really probably won't come to anything. You need proof, and do you really think the DA is going to spend the time/resources required to PROVE that this other individual accessed another's video game account? I don't think so.
This is a reality check. OP needs to use strong passwords and not hang with people who pull this crap.. end of story.