Have both of them add a new password to their saved passwords and find out if it shows up on the other's phone. If it does, that's a big problem but at least it can be traced. If not, it means that some saved passwords migrated to Edwin's phone for some reason, but it's not being actively synced.
Someone had to have signed into iCloud and then keychain on the wrong account. That's been end-to-end encrypted since day 1. I just can't see a way this would have happened otherwise. You can't airdrop an entire keychain and I think family sharing of passwords is recent, plus you said they're not in family sharing. And this has nothing at all to do with the Ghost Energy app either.
Keep us posted.
Google knows exactly what you're watching and when you're watching it. Not so much if you just archive everything.