It's possible he obtained the information through other means. While spyware can exist on iPhones, it's extremely complex and will cost about $500,000 to compile and deploy against a single target. Unless this guy has money lying around to burn on something like this, it's unlikely he compromised the device.

Either way, it's not a healthy thing to do and they should do something about the root cause of his insecurities.