Can anyone offer advice on this situation?

Someone is able to view every website my friend views on her own computer and also on her sister's computer. This person is able to use his own computer to view everything my friend views online as she views it. While he has had access to my friend's computer, he has never had physical access to her sister's computer.

Any thoughts on how he's doing this and how to stop it?

There is a thing in Windows called Remote Desktop and Remote Desktop Sharing.  Maybe this person is using one of them.  You can shut them off by right clicking on My Computer in Start, choose Properties from the popup menu, go to the Remote tab, and uncheck the Remote Assistance checkbox.  Hopefully, that will take care of the problem.  If it doesn't, there is some type of software installed on their computers that is allowing this.  You will need to find that software and remove it.