If he's running it from a personal cgi-bin directory, then quite likely it's running under suexec, which is extremely finnicky about permissions. In particular, the permissions in his cgi-bin directory (and his home directory, which I assume is cgi-bin's parent) should probably be set to 711 (though 755 might be ok). To see If the script really is running and it's just generating an error, add

use CGI::Carp qw/fatalsToBrowser/;
[download]

near the top of the script.