Friend got NFTs hacked/phished from OpenSea, can someone tell us how?

Hi everyone,

A friend of mine just got hacked on OpenSea, where a bunch of NFTs got transferred out of his wallet to the hacker's wallet.

As you can below, the hacker himself initiated the transaction, not my friend.

https://imgur.com/a/4f5ZgsC

My friend claims he never signed any TXs, but apparently signed a message (not a TX) on a potentially dodgy website. Is that enough to then steal NFTs listed on OpenSea? And if so, how exactly?

Thanks for your help!