After some investigation, my girlfriend's now ex friend admitted he got to her phone through WiFi. From there all her Google (Drive), Samsung (Cloud) and Microsoft. He's totally messed everything up but says he doesn't know how to put it right. Files have been moved all over the place. Google Drive is almost full but we can't see what's on it because he's been pretending to be her on his laptop. When my girlfriend tries to do something on Google, Samsung or Microsoft, it thinks she's a third party and won't let her.
As for 2 OSs. Its hard to explain on text but it appears the phone is being used in other places. places we haven't been. It doesn't seem to be the main phone as trying to sign in on anything it says already signed in or account already exists. Thanks