It is illegal. Try it and you're looking for trouble. It will also leave a footprint, so There are other ways to acheive the same thing.
I suggest your friend install software on THAT person's computer himself instead of going with spyware. He might need to say he needs to send email from that computer and install it.
There are programs that will put EVERYTHING that a person types into a file. That will make sure you know any URL that is typed, any email that is written, and any instant messaging that is done - except you won't know what the replies for the emails, instant messanging etc. were.
Then your friend can go back, say he needs to check his email again and retrieve that file.