You might want to rephrase that. The way I see it is this:

Your friend bought an iPhone.

Said iPhone is stolen, which your friend was aware of when he bought it.

This friend then jailbroke the phone.

It is connected to T-Mobile's network.

IDevices have what is called a UDID, a Unique Device Identifier, which is different for every device. This is supposed to be totally anonymous, but there are ways of finding who is using a device using its UDID. If the phone was stolen, the previous owner may have documented the UDID and/or the serial number, and if they want the phone back, they could find your friend without too much difficulty since he connects to a network (I think). However, the chances of the previous owner doing that are very slim. I wouldn't do it, and I like to think of myself as "tech-savvy."

BUT in the event your friend is approached by the police, I am not 100% sure, but I think he could get in trouble if he knew the phone was stolen. If he did not know it was stolen, I think it would just be an inconvenience and the police might confiscate it.

I personally would get rid of the phone. I would not want that liability. Just in the future, make sure to avoid buying stolen things. They might come with strings attached. For instance, if someone were to steal my phone, I have it set up to connect to the network and send me their location. If everything works out for me, I could call the police or handle the matter myself. Long story short, I would not want to be the thief of my phone because I might end up dead or in jail. Keep in mind that thieves are probably not "tech-savvy" and would never think I could show up at their door and stick a gun in their face.

Hope I scared you!