If the account is not in their name, they have a risk (your brother & friend's situation). Its just a matter of if the risk is worth the reward to them:

Risk, something going wrong, & them getting banned from there account completely.

Reward, not having to level 1 lvl 70 again.

Personally I'd take the account back, & start over. At least then he doesn't have the risk of starting with "NOTHING!"

I'm only speaking from experiance as a multiboxer who played an account not in my name (Fake Name) & got that account banned with 2x Epic'ed out 70's.

Good luck with whatever you or your brother decide to do.