Good precautions but for the last part also check for physical keylogger on your PC at home, no point changing passwd at work and coming home typing the same pwd regardless.

Still doesn’t answer how they are getting this information off his phone.

Although a more likely scenario is his wife accessing the information herself through either physical access of the phone or he leaves his accounts logged-in on a shared laptop at home.