The only reasonable explanation I could come up with is him somehow getting your google pw (shouldn't be that hard if you wanted to do it to someone you know or is on the same public wifi) and then sync his (spare?) phone with your account.
Upvote
0