Login as another user who has an SA-equivalent role
"i did'nt even turned on Windows Authentication"
Does that matter? A Windows Administrator [on the Server itself] will still be able to get in to SQL Server - unless the Admin role has been explicitly deleted, won't they?
Or Reinstall SQL Server, and restore the databases from backup (presumably NOT included MASTER!)
That's presuming that this question isn't: And how would my friend automated this for ALL the web sites he "looks after"