Besides resetting every password (assume any password stored is known), force logging out all devices with password change, and setting two-factor approval for logins I would:

For listed devices on account Make sure he checks serial number of devices and not just the names of devices.

Under apple ID using https://appleid.apple.com/ check for any added contact phone numbers or emails.

For any device he had with him:
I would also make sure there isn’t a device management profile installed.
https://support.apple.com/guide/personal-safety/delete-suspicious-content

Under messages in settings check for unknown devices being forwarded texts (regular texts)

I would also check what Apple ID is being used there in settings/messages for Messages (may be under Send & Receive). May only use phone number to send and receive iMessages, but if linked to an AppleID under Messages he needs to verify it’s his. You can use a separate Apple ID from main one on phone for Messages and FaceTime. It can be set to only send & receive using phone number only even if an iMessage account is also logged in, so friends and family wouldn’t notice anything coming from a strange appleID. Adding another AppleID there and then linking to his number could explain why no unknown devices on account, and it also would not be affected by resetting and changing his appleID passwords.

Would have likely have needed access to phone to associate phone number, but I would not rule that out just because he didn’t see her.

Check fingerprint or FaceID for additional ones. If he set multiple one he would need to make sure they work as she could have deleted one to add hers to not show an extra one or just erase all and redo them.

Document anything unknown.

In general do a safety check every now and then.
https://support.apple.com/guide/personal-safety/use-safety-check-to-stop-sharing-ips16ea6f2fe/1.0/web/1.0

Turn on Stolen Protection which requires thumbprint or faceid to see or change certain settings (again make sure thumbprints and faceid are your own).

Set up a restriction with different passcode under screen time/content & privacy restrictions to then set up locking up account info on device under settings and/or locking up passcode settings. When you want to access them you do have to go back into restrictions and turn on access and then turn access off when done, so passcode cant just be used as an one time override which can make this a pain if someone accesses account areas in settings often or changes unlock passcode or other settings under Passcode often.

This post was edited on 5/7/24 at 3:22 pm