Changing the password is absolutely the first step if you suspect the account has been compromised, but are you certain he hasn't just accepted the invitation to a Shared Photo Stream. In that case he would get downloads of photos from anyone who added photos to the Photo Stream.
You can read more about Photostream features here:
Photo Stream Features: http://www.apple.com/icloud/features/photo-stream.html
Using and troubleshooting Shared Photo Streams: http://support.apple.com/kb/TS4379
Photo Stream FAQ: http://support.apple.com/kb/HT4486