There's a wealth of 3rd party software running in the background of your computer, if your friend hasn't modified his client in any way to gain an unfair advantage or using any macro/botting/scripting program, it's very likely that his account has been compromised. I'd highly recommend have them send in a ticket to Support and ask for clarification and/or appeal the suspension. If there's evidence that his account was indeed compromised, he will likely get it back.
I'd also suggest that they do a thorough Virus/Malware scan to ensure that nothing in the background is "monitoring" their activity, as this can definitely cause some red flags in the system. I don't believe NVIDIA Geforce Experience would cause any issues, I've been running it since 2012 on this computer with no issues (aside from the drivers being an absolute nightmare at times). I also run the Logitech Gaming Software for my mouse (G502) and it's able to change the key bindings on the Mouse (i.e. Mouse Button 4 [Back Button] to Keyboard F or something along those lines, as well as running multiple "macros" on a single instance - don't do this in League, it's a sure-fire way to be flagged since it's a competitive game). It also helps keep the DPI in check with relative ease.
There is a strange suspicion I feel that if your friend has any sort of "macro" software that causes multiple keys to be pressed in one instance, that could lead to being detected by the system as an unfair advantage. Something like AutoHotKey people have abused for the purposes of Botting or a simple animation cancel on a champion like Riven. While it seems minuscule, it's a definite unfair advantage for the players that actually put the time and learn how to properly do it, instead of a "Hold down Q to Auto-Attack, Q, Cancel-animation with movement command, Auto-attack, Q, etc." It's similar to if a player had their entire combo on Katarina unloaded in a perfect instance in the blink of an eye with a single key. While games like WoW support it (mainly due to their being a MASSIVE amount of abilities/items/etc. able to be used - I had a little over 120 key bindings on my Hunter, I couldn't imagine adding 50 more, there's simply not enough space for my hands!), many fast-paced competitive games frown upon it since there are often fewer bindings to be had.
Make sure to check if any of the programs running in the background are reading the memory of things, and check if there are any "leftovers" of the skin programs that were used. MKLoL and many others have been flagged as bannable, however they usually send you an e-mail as a "warning" to let you know they've detected something minor and give you the opportunity to fix the issue. If it's something major like scripting, they'll instantly ban without any warning as it's one of the "you know what you're doing" sort of situations.
For reference, I've been using custom skins for years without any issues. The main problem Riot will have with it is if you're swapping skins DIRECTLY from theirs, like if you swapped the base Lux model, voice-over, particles, etc. for Elementalist Lux, as it's infringing on their property at that point and bypassing the system of buying the skins that you want that someone at their office spent their time (and Riot spent their money to pay them) on. One of my personal favorite skins I would gladly buy if it came out is Pool Party Heimerdinger with Rubber Ducky Turrets and bubbles where the usual hexagonal patterns are.
I hope that your friend is able to figure out the issue and get it resolved and I wish you both the best of luck in this!
