If this is a work computer, refer the situation to the sys admin. they should have a procedure to follow. Also don't be too quick to rule out hardware keystoke recorders, they are cheap (~$40) and would be easier for him to install on your work computer most likely. Something clipped onto the keyboard cable since keyboard cables tend to not have ferrite beads on them since the power. (at least mine never do, but I tend to buy the super cheap keyboards heh)

I think it is important that you start with the sys admin though, if you don't want your friend to get into trouble, just make up something about the computer acting up. I don't assume you have the required permissions on the system to do too much else as far as installing new scanning applications and such and it is always best to follow proper channels, especailly if you acidentally mess something up.

best of luck

catch