This actually happens a lot. Car is stolen and driven to, say, an apartment complex. It's looted.
The apartment complex doesn't allow unauthorized vehicles, so their tow company is called. The tow company just drags the car to their storage lot. Since they don't have access to the DMV records of who the owner is, they can't contact anyone.
Eventually, the cops find the license plate and determine the owner. The owner is called, but the tow company wants all that money to release the vehicle.
The best option is insurance. If your friend had comprehensive insurance, and the police validate the theft, then his insurance will likely reimburse most if not all of that expense as part of the theft claim.
Obviously, the details matter. It sucks, but it's hard to fault anyone involved. The tow company has to do their job, or there wouldn't be anywhere for the residents to park. They have money invested and have to pay their driver and people. Yes, tow and impound fees are infuriating and maybe too high, but they're just following the rules too.