Right. If he admits, it was purchased for CTB, based on the German "Gesetz über Hilfen und Schutzmaßnahmen bei psychischen Krankheiten" act (PsychKG) he will be taken to the psych ward due to self-endangerment and will suffer a penalty order.
If he claims, he had never ordered that package, they have to prove, he did. A raid can be the result and the confiscation of computer and mobile phone, if this devices are still there.
If he is lucky and the package is going through Frankfurt customs or they do not test on barbiturate, then everything is fine.
No one knows the outcome. It's gambling. You can be lucky or not. One should have a plan for every scenario in advance. Without risk no N to Germany.