It's a good point actually - does iCloud in any way prevent multiple account logins? There's another possibility: he re-used his iCloud password on another acc

It's a good point actually - does iCloud in any way prevent multiple account logins? There's another possibility: he re-used his iCloud password on another account, that was compromised, and someone tried that successfully against his iCloud account. The bigger issue, as someone else has said, is putting so much remote control behind a single point of security.