If it is a password just keep entering incorrect.
Over 10 attempts on a password will reset the phone.
If it is a MEP code that would be the code to unlock use with another provider. Then your friend will need to get that from AT&T or you can pay a online service to get it.
Since it is not a T-Mobile phone, they can not help in that regards.