My friend just got banned. Hackers may be to blame

Note: My bud has already contacted player support prior to his ban however he received an automated copy+paste response about account recovery when he simply wanted unusual activity looked into. He was most concerned as to what they may have done with his acc (scripts, racism, his account being used on a different IP triggering some form of account selling detection) and I found out he was banned moments ago for an unspecified breach of riots terms of use (it didn't specify what he did, merely pointed him at terms of use pages).

HOWEVER I WANT TO PRESENT MY OWN CASE IN HIS DEFENCE!

https://oce.op.gg/summoner/userName=MrKoala This features 5 pieces of information that someone other than him was using this account

1. All of his mastery pages have been deleted except for one
2. This one mastery page you will see has been titled "Get a Secure account" (he left it as is for the sole reason of evidence, he could've deleted it or renamed it)
3. His runes (not the page names) have been changed and the final 2 have had their runes removed (not the case before the date below)
4. His icon was changed to be a minion, however thanks to the slow match history system I can see his old icon. The iceborne keeper, a harrowing icon which he's used since he got it. http://imgur.com/a/fFMpo

5: 27/4/2017 2 games are played on my friends account, a camille game and an Azir game. My bud is a FOTM player, azir is far from that and he's only played 4 azir games (excluding this one) EVER! the most recent game was a year ago. Now here is what is interesting. My friend plays league almost entirely because it's a FTP team game, he almost never plays without at least one of 3 mates, me being one of them. When he isn't it's because he's playing ranked and to be quite frank...... he is such a handicap that we simply refuse to rank with him. If you want the names of the other accounts associated with our other mates I will present them. However for now I've left them absent out of respect for their privacy. We see, in the 2 games played.... 2 new players that none of the 4 of us have ever seen before (you can see them easily in the TT azir game). The very maps played tell us something is up. He hasn't played TT since 16/6/2016, why play one, and just one, with those 2 players in particular? He hasn't played an ARAM in approx a month, and we play those when we're bored of summoners rift, almost all of them are played with one of us (his 3 mates) These 2 new names never show up as far back as I've searched through his match history

And a 6th piece of info. He is currently running, on phone data. The little data he has to play league with is precious and he reserves it almost purely for playing with us. Why'd he have a 3 man, with people who'd never shown up before without trying to get a 5man team together? He never skips a chance to have a 5man of IRL mates, because it's simply too good to pass up.

As his mate I can vouch for him not scripting. He's managed to play on this account since season 3, as a rock solid pleb just like me and without cheating. So why the hell would he start now? And why the hell would anyone use them on twisted treeline and howling abyss of all maps? Maps that have no ranking significance on OCE.

Riot, I ask that you look into this. As I can guarantee that this is a mistake. I'm willing to bet my own account on it and trust me, I've spent a sh*tload of money on this thing.

EDIT: RESOLVED! It was disabled in order to prevent further tampering. It's been unlocked and we're about to partay.