I may be wrong but I believe CarFax only guarantees that its reports show reported accidents (accidents reported to police or insurance), otherwise, CarFax would have no way of knowing the vehicle was in an accident unless it inspected every vehicle a CarFax report was run on.
For example, I recently bought a Chevy Malibu from somebody who struck a deer causing damage to the hood, front bumper, and headlight assembly. His insurance policy didn't cover the damage so he never reported the accident to his insurance company or the police (accident wasn't disabling). Therefore, CarFax has no way of knowing that an accident ever occurred (don't worry, I'm fixing it for myself, not to sell).
I'm assuming a similar situation happened with your friend. Very unfortunate situation from him, especially since there was damage to the frame rail. I'd echo your statement about having any vehicle you're considering purchasing inspected by a trustworthy mechanic.
Edit- Hopefully I didn't just freak everyone out who regularly uses CarFax