In order to access GPIO's you must run as root as Linux will not let you play around with the hardware without the right privileges. So you are right that you need sudo, but i suspect your friend is also running as root somehow (see previous post)
Principal Software Engineer at Raspberry Pi (Trading) Ltd.
Contrary to popular belief, humorous signatures are allowed. Here's an example...
“I own the world’s worst thesaurus. Not only is it awful, it’s awful."