Although this isn't the answer your friend is looking for, if I were them, I would create a new user password, add myself to sudoers, and then lock the root account. It seems like a security hole to allow logging in as root at all.

Another technique for changing the password could be using a live CD / USB to chroot in and then change the password. I believe you have root permissions at that point.