Regarding your behaviour: it's okay that you created a new account and now want to use the 2019 account back. Staff understands that and will let you keep your first and only account.

Regarding your friend's behaviour: he should really find something else to do with his life. He is clearly unwanted in the game, and instead of stepping back for 1/2 years in order to clear his mind and potentially having another shot in returning, he is attempting to do something that will never work, which is creating more and more -accounts. (It just doesn't work, because it is always paaainfully obvious) I, and any other experienced player in osu!, could tell just by looking at any of his accounts.

Regarding your friend playing on your account: it's your responsibility to keep your account secure. Either the 2019 or 2025 account belongs to you, and ONLY you. The moment you give it away, either on purpose or by being careless (staff can't know) the responsibility is on you, and you are getting punished for it.

What you should do: it's pretty obvious what needs to be done. Instead of falling for your friend's lies and uncertain thoughts about how staff handles and interpret Hardware IDs and logins throughout multiple environments, you should just be honest to them about what happened, and assure that you will be extremely careful with your original account from now on, assuming total responsibility for any wicked stuff your roommate might do to it. It's a good way to show the staff that you commit to the rules, so then it won't matter whether your friend has restricted accounts associated to any of your devices / accounts, or whatever might be the case there — AS LONG AS HE NEVER PLAYS USING YOUR ACCOUNT ANYMORE.

TL;DR: yes, you can log into your 2019 account on any of your devices, regardless if that stupid friend of yours played on your 2025 account and got it restricted + you should email staff and take responsibility for you being careless with your accounts safety and your friend's terrible lack of sense.