Photos that were not taken on any of our devices are showing up on my Photo Stream. My son recently had his iPhone stolen, and he had Photo Stream turned on, so I am guessing that the photos are coming from the person who stole his phone. We reported it stolen with AT&T, and erased it on the Find My iPhone app, so what else needs to be done so that we no longer get those photos?
If your son had the FindMyPhone app installed, you should be able to go to iCloud.com, log in and find and erase (wipe) the device. If it ahas been some time, contact information, personal details, credit card info are all at risk. I suggest getting him to change all risky numbers. Perhaps notify contacts to look out for spam/rubbish/malware etc.