Most people don't back up virgin systems, but there are several valid reasons to do so. My own main reason, is to give a great big * * * * you to whoever decides they need to read the disk if I need to return the device. A different reason is to simplify reinstallation later if you actually use the OS that was preinstalled. Persons with a bit of foresight sometimes prefer to take occasional snapshots (another name for backup that does not refer to personal documents) of their systems so they can revert quickly if their drives break or they do something they regret. A full backup of a 500GB disk takes at least an hour and a half if it's ripped out of the computer and connected to another, 4 hours 37 minutes to a USB drive and 11 hours over a 100mb/s network connection. (Time is proportional to capacity, easy to scale.) More or less time is required depending on whether compression is employed and if one makes assumptions about, or disregards unlinked disk areas.
However, what you describe is an archetypical example of social engineering. If the computer is for a single user, and not managed by an IT department, there should be very good reasons before somebody apart from it's designated user is given the ability to make changes that normally require greater privileges than that of a generic user.
I would suggest your friend speaks to the management in her company about this strange behavior in her coworker, and have someone with the necessary knowledge confront the coworker about it. Depending on the circumstances, a suitable reaction could range from a disapproving message to criminal charges. (Assuming the episode is somehow related to the company.) Afterwards, she should obtain installation media for her operating system and wipe the disk before reinstalling and producing any backups she requires.