My friend's address was spent right after I paid him. What happened?
If I read it correctly, your friend had an address, to which you paid. Then someone took it from their wallet?
It might be because your friend's device is hacked or he doesn't use a trustworthy wallet.
Or it was him who spent the coins. It's also possible that they are lying to you so that you pay them again.
Double spend attacks involve the same person spending to two different addresses. Since your friend is not the voluntary author of both transactions, this is not double spend.
I can't comment further without more info.