Is the account being debited a UK bank account?
From the bank statment who does it say is issuing the direct debit, sky or from someone else.
Does he have more channels than the freeview ones, ie is he using the same card as he would if he was in UK. This would include films and sport.
Some people have reported on here that they keep a sky box in their Spanish home and just bring out the card with them. Can't remember exactly what they receive.
Why not try another thread asking for information of exactly what should be received by using a sky card abroad. I think it's more channels than their Freeview card as that is similar to a freeview box in UK.
If your friend rings Sky there's a good chance that he will be disconnected, I'd try that as a last resort, better to do some further investigation.
Just had another thought, I'm sure I read that if your card is disconnected by Sky then it becomes a Freeview card in Spain. Apologies if I'm mixing up the Freeview with Freesat but what I'm trying to say is that he would have the basic channels as you have so even if this bunch of rogues disconnect his card it should still work.
As you're a new user I'll pm a few people to ask them to help you. They might not read this thread, they might read another if it mentioned something on the lines of Does a SKY card work in Spain. Lots of techies on here, just need to find them.
I'd also email the Sur in English and try to get a letter printed to warn off others if it proves to be a scam.