I'm guessing those buttons are what you click to set your pick with blue buttons being what you picked already?
Look at the form those buttons are in. The script probably disables buttons during a game so you cannot "click it", however, if it probably fails to check at the backend if its allowed to make a setting during game time. (OR, if thats not how he does it there may be an sqli vuln in there somewhere, probably not checking if the id's of the pick are ints)
Look at the form those buttons are in, there will be data to identify which button is which like a name or an id, or hidden data, or submit value or something like that(all depending on if its a separate form per pick or one huge form with the value being in the button itself). Then check the disabled button and find what changed to disabled it. There are 2 options here, either it just set them to disabled or totally removed the values identifying them which effectively disables them. In the first case, enable them again with firebug and then click. In the second case, write down the values before game time, fill them in during game time and click to change your pick. Possible alternative, open the page before game time, keep it open, and click during game time. It'll all depend on how its made. But if your friend is able to change his picks this is probably how he does it. (or since theres also a save button, I guess the buttons are a type of checkbox/radiobutton, in which case the same as above applies but with checkbox/radiobutton values or id's and not button values)
<Yoda> if someone says something i don't like, i ban him, ban whoever defends him, and then ban the witnesses...