Go in to activity monitor and inspect and sample the process. See what shows up.
Without any real information to go on, I'm going to assume this either has something to do with sharing settings, or network settings. When it's a process called "socket" running at 100% it seems pretty safe to say that this process has something to do with the computer acting as a server of some sort. Does your friend do anything with servers, playing around in terminal or trying to create web applications or something?
I'm assuming he's running Leopard/10.5, right?