Someone not on Wifi network playing music?

It happens because he associated YOUR Sonos units with his Spotify app so when he plays music he can select to play via your speakers.

I don't have Spotify but I assume he either set-up Spotify on your Sonos or he added his account details. If you don't subscribe to Spotify then first thing is to remove Spotify from your Sonos system or if you do remove his registration details.
As far as I have read there is NO way to remove the association between his Spotify app and your speakers.

Also. Have a word with him and let him know what's happening

I recommend contacting SONOS support. Having your friend close the Spotify client might clear this. Have you given your Spotify account information to your friend? If so, I recommend changing your Spotify password.

I'd like to tag an additional question on to the OPs. Is it possible for someone to associate their Spotify app with your Sonos speakers if they aren't on your wireless network?

Some further information:
1. I didn't give him any login information
2. He is able to play music on my Sonos even when he is a mile away and not on my wifi! That's the part I don't understand.

[...] 2. He is able to play music on my Sonos even when he is a mile away and not on my wifi! That's the part I don't understand.
That is an intrinsic feature of Spotify Connect.

Some clarification for everyone. He was able to connect to your Sonos players within the Spotify app because he was at your house and on your WiFi. This created a link for him which allows him to play from his Spotify app, to your system when no longer on the WiFi network.

To break this connection, play anything else on your Sonos players. As soon as the players are told to play from a different source, only devices on the wireless network will be able to set up this direct connection again. As Smilja said, this is a feature of Spotify Connect. The bit about breaking the connection is part of our integration so you don't have to worry about guests after the party ends.