No 'hacking' going on here - his account has only ever logged in from devices used by him and you, noone else.