No sms spoofing, there’s only two possible explanations: your friend sent it and deleted. The bar tender got an app that allows him to inject a fake sms.

My guess is it was the first one because the address was there.