As Jason noted, if he created a bromide bank either by adding sodium bromide after a water fill or by using bromine tabs, then ozone will generate bromine from the bromide in which case the spa may be sanitized and OK. If he doesn't have bromide/bromine, then his spa is not properly sanitized or as Isaac noted, there could be a copper/silver mineral sanitizer that can help control bacterial growth. There is a small amount of residual ozone that gets into the spa water, but it is not supposed to be very much because it can outgas and is an EPA-regulated air pollutant. Also, the ozonator is usually not running 24/7.
Whether a spa gets bacterial growth or biofilms is dependent on many factors so appears statistical. I tracked numerous cases of hot tub itch/rash/lung on another forum and the use of too little or no disinfectant or use of alternative disinfectants appeared to be the primary cause and there were cases that occurred in spas that had ozonators. So just as there are pools that are improperly maintained but don't show algae, you can have a spa that appears OK as well -- that is, you can get lucky.
So to have the least likelihood of getting problems from a hot tub, it is best to maintain a proper disinfectant level at all times (after initially removing any biofilms if it wasn't properly maintained earlier).