Thanks Milo.
He is, like me, a Luddite, and has a simple basic Nokia handset (2730 I think). He says he only received texts and neither sent nor received pix/MMSs. That is most likely correct as he would not know how to send an MMS and his phone is probably not set up to receive them, I know mine isn't even though it is apparently capable.
I've just spoken to him and he doesn't see how his handset could have been compromised, he got it new and unlocked from a Nokia Care shop and put his O2 card into it.
Anyway, can you confirm at least that my initial contention, that it is not possible to call a normal UK number and get billed for an international/premium call, is correct?
If so, that helps somewhat in getting closer to the problem.