Based on what you mentioned about her using your phone, it is very doubtful that the ex of your friend has access to her iPhone, via a jailbreak or other means. If anything, the ex likely has access to the email account that is linked to all these other services.
I would check her email settings to make sure the ex is not linked as a recovery account. If there is nobody linked as a recovery account, start by changing the email password. If the ex has access to the email account, they can use security notification emails from various accounts to change those passwords again.
Make sure to use strong, unique passwords for each service. Never reuse old passwords. A password manager would be helpful here.
Then, it would be highly recommended to enable 2-step authentication. Google has some info about that here, but this will be different for other email services. This prevents people from logging into your account, even if they know the password.
I would then change passwords and enable 2-step authentication on other accounts.