to be perfectly blunt, your friend is being needlessly stubborn about this.
the celebi might actually show up as legit on a hack check in legal. this is where the common sense part comes in.
http://projectpokemon.org/ checks the inner-workings of the game, including events, and determines things like what i said that events are either shiny or NOT shiny depending on the event.
they find the algorithms for the events and have determined that this is how they all work.
the only exception is manaphy, specifically designed to never create a shiny in one's own game, doesn't have a check to make sure it won't hatch shiny in someone else's game.
this is an article on the shiny prevention for events (and a little bit on how it failed with manaphy):
http://projectpokemon.org/games/mechanics/shinyprevention.php