Stalkerware: Friend’s Ex has live access to his phone activity

Cliffs:

Out of town girl somehow gained access to all his social media and iMessages. She went through his messages while FaceTiming with him.

He sees no strange devices registered under his Apple ID. Thinks she might have used his iPad while he was visiting her.

How can someone detect/prove someone has illegally compromised his phone?

I advised him to change all passwords and reset his iPad