Need Help - lost coins!

Hi, I need your help to understand a situation where a friend of mine has lost coins and I can't figure out how:

I explained to this friend how he can buy bitcoin and keep it in self-custody. I opened a wallet with him and transferred the coins, he bought on an exchange, to it. Now he has done it again himself but the coins have ended up on an unknown P2PKH address and I don't understand why, here is the process and the exact problem:

1. (January 2024) We created a new wallet together for him on my bitbox02 and he wrote down the seed phrase
2. (January 2024) We sent his coins from the exchange to an address that we verified with the bitbox02 (TX: b2bd5c68966f4d09403f30d64be343002b1a5820cb48f0e5773d1c6a28d40f63, address: bc1qxcfyzs40aapfsl5tru6clyeqvfm79ppjtwuwzu)
3. (January 2024) We have set up a watch only wallet with the xpub of bitbox02 with electrum on his and on my laptop (so that I can support him remotely if he has questions)
4. (January 2024) I have seen the payment receipt in the watch only wallet (electrum) to the above address on my laptop

So far so good, now for the problem:

1. (May 2024) He bought Bitcoin again on the exchange and wanted to send it to his wallet. The exchange is Bison (a German exchange). To do this, he right-clicked in electrum on the address that already had credit and selected “copy” in the context menu. He entered this address in bison for the payout. That's what he told me. He is a bit older but is good with computers.

2. (May 2024) At Bison you get an email with the address you entered to confirm the payout again. I looked at this mail again with him and here it is: The address 1Mfof9zpv5KU5i6q2F3XxXAnz4iNmTTK9q is given in the mail. Unfortunately, he probably overlooked this or did not compare it again with electrum and confirmed the payout to this address, which was then also made by the exchange: (TX: b098afd631214752fc63ede751e1445c207c4a79b5330db53e755bf2b70315c1)

3. I tried to understand what happened here and I noticed that this address already received a small amount from the exchange in January 2024 when TX was transferred from the exchange to its wallet. Only these two transactions happened to this address.

I am trying to understand what happened and possibly get his coins back. My idea so far: The only thing that connects these two transactions is that they both come from the exchange, is the “unknown” address possibly a change address from the exchange? But even if it is, how can my friend accidentally copy this address and enter it as a payout address at Bison? He explicitly said that he copied an address in electrum via “right-click->copy address” and he doesn't know of any block explorer where he could have looked at the first transaction to copy a wrong address.

Or could it be that electrum uses a different derivation path or something similar on its laptop and therefore outputs this address format and I just don't see the address in the watch only wallet on my laptop? But then why should a small amount have already landed on this address with the first TX? None of this makes any sense. What would a possible scam (with malware on his laptop?) look like so that this address was already involved in the first transaction?

I am grateful for any advice! sorry for the long text!