Getting an event legendary with flawless IVs, in past generations at least, is extremely difficult, so close to impossible. It's a good chance that they maybe hacked, but the source needn't be your friend. Your friend could be an innocent victim just like you - got it without ever realizing that it's so perfect. You could report him, but do let them know everything & they can decide whether he should be banned or not.
When it come to hacking, if done neatly, then you really can't differentiate from a legit one. Professional hackers look at hacking as simply a short cut to achieve the same result. As far as you are concerned, it's legit for you since it passed all the checks. Everything is correct & you get a the bonus of IVs being perfect. It won't destroy your game - it's not a like a virus.
Whether you want use it - that's a different & personal dilemma. It's completely up to you. IVs are useful, but their ultimate effect in stats will a difference of 31 points. You could say every point counts, on the other hand it's not like you have a major advantage against everybody else - like using an uber in a NU match.
Finally, not sure about Lugia, but Blazikenite can't be hacked as of now. So the only way to get it is to obtain it from people who have downloaded a legit Torchic.