How can I trace who has hacked iPad

Question

I have just bought a new iPhone and used facetime for the first time with a friend using their ipad (supplied by work).
A few days later I received a strange facetime call,  supposedly from my friend, showing just a black screen and no one talking. A few minutes later I  received (malicious) imessages on my iPhone. The senders name appears on the message as the same friend I facetimed. My friend is NOT the person sending the messages!!! 
I have subsequently facetimed my friend again a couple of days later, and during the call further malicious messages came through (it's a bit scary!). How can that happen when in the middle of a facetime call to a friend, and someone else using the same email address to send nasty messages?!
My friend is listed on my contacts showing his phone number (non-apple), and the email address designated to his ipod by his workplace.
My friend's only apple device is the iPad supplied by his place of work. The ipad is connected to all their other work ipads (maybe by some cloud connection?), so the messages have appeared on all their ipads. I am now given to understand all the workplace ipads use the same email address (or rather I presume, the same Apple ID). The hacking can only be connected to that email address and/or facetime connection.
My friend is now under investigation by his workplace, and we are tasked with having to prove my friend's innocence!
The workplace IT department have taken my friend's ipad and are making their own investigations. I don't know what protocols they may have in place or tracebility there might be. Are there specific questions we can ask the IT department to ensure they check all they should be doing?  I don't know how the facetime/messaging works regarding traceability - should IT be able to trace anything by packet recordings, IP adresses or some other methods?
What can we do from our side? Are there any suggestions?

Answer 1

If all of the iPads at your friend's workplace are using the same AppleID, anyone who had it could have used it maliciously or given the information to an unauthorized person.
You were tasked by whom to prove your friend's innocence? What is your standing in this matter? The IT department will do its investigation. Your friend should consult their employee handbook for their options regarding privacy, use of company devices, and recourse if accusations are made.
Best of luck.