google “session stealer”. your partner probably clicked on the malicious link and provided hackers full access to the account. not sure if signing out of all devices helps, but do it anyway.