This app was mentioned in 6 comments, with an average of 1.17 upvotes
I'm assuming it's this app?
Since the phone isn't rooted, there are a couple things we can check.
Settings > Apps > 3-dot menu in top-right > Show System Apps. Look through the list for anything suspicious. (i.e. something he didn't install)
Settings > Apps > 3-dot menu in top-right > App Permissions > SMS > 3-dot menu in top-right > Show System. Disable anything that shouldn't have SMS privileges.
He should have an app called 'My Files.' If not, download a File Explorer app from the Play Store. In the app, navigate to Internal storage > Android > data. Sort by date if necessary. Look for anything suspicious here.
Last thing I can think of is to try MalwareBytes.