Stolen iPhone4S, is AppleID at risk?

My son's iPhone4S was stolen in Vietnam on 4 January. He locked it remotely using find my iphone then tried to wipe everything using iCloud. The status of that request is "pending" which I understand means the phone has not yet been connected to the internet? Will all data wipe the first time the phone connects to the internet? Should he also change his AppleID for extra security? Someone in Vietnam somehow got into his contacts stored on the phone, because I am suddenly getting calls and SMS from a random person in Vietnam asking me to contact the owner of the phone and ask him for the AppleID so they can use the phone! As if.

I am in Australia by the way. And my number was not stored as "Mum" on his contacts, I am wondering how could they know to contact me out of the 100s of contacts he had listed on the phone. If they have done this, is his AppleID at risk? He has changed all passwords to Facebook, bank account etc. This is my first question to the community thank you for any insight!