What is the eticket number prefix?
236 is bmi, Air Malta is 643. This will clarify with whom the contract is formed.
However, as I understand this from prior experience (and I am a layman, not an industry insider), the carrier who causes the missed connection is responsible for dealing with the mess.
Sadly, missed connections are not covered under the EC 261/2004 directive and thus care/compensation is not specified, which has always struck me as being very wrong.
Presumably, your friend has travel insurance? In such situations, I usually just claim against the missed departure clause and then let the insurance company fight with the airlines.