Even in the event that your friend is correct, it sounds like the author(s) of the new mod have not yet released it, so they are not yet committing copyright infringement for failure to attribute any Apache-licensed work they used. It sounds like they may have briefly violated the original author's copyright by releasing their source code accidentally, but cured that violation immediately. Assuming they do release their mod in source or binary form without attributing the upstream author, it is up to that author to prove the use of Apache-licensed code.
You have a copy of the source, which could be very helpful in determining infringement, and I think you are correct in not sharing any part of that source code without the new developers' consent: it surely contains original copyrightable authorship, even in the event that it also has infringing material. The GitHub terms of service permit you to "view" public repos on GitHub, so you were not wrong to copy the repository into your local computer memory (which is how "viewing" works in an online context), but you are surely not permitted to share it further. You could begin by using tools for detecting code plagiarism; this could allow you to say, "Plagiarism Tool(s) X found YY% similarity," giving mechanical weight to your claims without sharing the other developers'code.
It is possible the downstream devs misunderstand the license and are afraid that admitting use of Apache-licensed code will require them to license their own code in some particular way. Compliance with the Apache 2.0 license is extremely simple and does not interfere with the new developers' plan to offer a closed-source iteration of your friend's original mod. (Apache 2 is not a copyleft license; it does not require source disclosure!) Therefore, I would focus on explaining that your request for attribution is required by the code they've used but also practically harmless. They simply need to list the original author, unobtrusively, as one of several contributors to the project, by preserving their copyright statement and including a copy of the Apache license, but do not need to license their own code in any particular way.
If you come to them highlighting the simplicity of your request and with specific evidence of plagiarism, but they go on to publish the mod without attribution, I would probably hire a lawyer who could draft a cease-and-decist letter and who could more clearly outline how you may and may not use the now-removed source code to prove infringement. In the event their mod is hosted in the U.S., you could also issue a DMCA takedown request to whatever provider is hosting their mod. However, they could make a restoration counter-request, at which point you'd be back to contacting a lawyer.
For binary distribution, the Apache 2 license requires preservation of any copyright notices present in a NOTICE file. If the original mod did not contain a NOTICE file, then unfortunately, the Apache license does not strictly require the new mod to preserve any copyright notices in the binary (but it does still require preservation of notices in any source distributions). However, it does still require the distribution of a copy of the Apache 2 license text, and probably the best way to disambiguate the licensing of each component is for the new mod to say something like, "This software includes components with are Copyright 20xx-20xx [Upstream Author], and which are licensed under the following terms: ..." I would suggest asking for that, which lets the new mods meet their requirement to keep a copy of the license without introducing ambiguity while giving attribution to the upstream author.
