iPad hacked while being repaired?

My iPad mini (Retina) had a broken screen so I put it in for repair.

Prior to giving it to the repair company I deleted everything sensitive from the iPad: Signed out of iCloud, deleted mail accounts, deleted photos, reset settings, etc, etc.

I left on it about 100GB worth of movies and TV shows which are manually managed and I wanted to keep, and in addition it seems also some iBooks, which didn't get removed after removing all the account data - but I suspect that is an Apple bug.

Specifically, I deleted all photos, and then permanently deleted them from the 'Recently Deleted' Album so there were zero photos anywhere on the device.

After receiving the repaired iPad back, the 'Recently Deleted' album now had 3 photos in it. I assumed these to be test photos the repair man made to make sure the camera was still working after the repair, however, the number of days until deletion was shown as a huge negative number of of days, like minus eleven million and many thousand days, it looked very weird and made me suspicious that maybe some kind of 'undelete' utility had been run over the iPads internal memory to look for deleted data.

Further, my iPad (iOS 8.3 - 128GB) had about 3GB of storage free and it reported that an iOS 8.4 update was available, size 386MB. so I chose to update and left it downloading (over a slow cellular connection). After a few hours I went to check progress and had a message that the storage was full. I used iTunes to delete some movies freeing up another 7GB and set the update off again.

When I next checked, I had a storage full message again, so deleted all the Apps to release another 2GB of storage and then tried to continue with the update.

Again, after checking the update progress, I find the storage was full again and the update had stalled. So thats 12GB of storage I released for a 386MB update and it still can't complete without running out of storage. Something is wrong.

I went into iTunes and got the message:

So I went to manage the device contents (in iTunes) to delete some more videos but whenever I deleted a video, rather than freeing up space, the space was instead added to something called 'Other' so the storage remains full...

...and in addition, the videos were not deleted either, even though the 'Other' space grows. I can still watch the 'deleted' videos on the iPad.

Finally, I tried deleting the videos directly from the Video App on the iPad. After choosing Edit, I can hit the 'X' to delete the video, but the confirm box is shown with the buttons greyed out. Hitting the delete button clears the confirm box but the video is not deleted.

I can think of 4 scenarios.

1) The download is bigger than expected. I can discount this because 12GB should be enough and it doesn't explain the iTunes and Video App problems. Also my cellular data speed is too slow to have acquired that much data in the time available.

2) The repair man has stolen my memory chip and replaced them with broken/fake ones.

3) The repair man has damaged my memory chips.

4) The repair man has installed a hack to send continuous screen captures to a server to try to steal sensitive data from me, and due to my slow cellular connection the device is getting full.

I should mentioned that I'm currently in Thailand, where total incompetence and corruption are the norm, so 2, 3 and 4 are all equally likely. It would be pointless speaking to the repair man as he doesn't speak English and if 2, 3 or 4 are true he would simply lie about it.

What is need is more information to figure out what is actually happened. It doesn't look like the device has been Jail-broken, so I need to know if it is possible to somehow mount the internal Memory of an iPad, say via the USB cable or wirelessly, so you can read and modify it via a computer. This would explain both how an undelete utility could be run, and also how a screen capture hack could be installed without jailbreaking.

Apart from that, does anyone have any ideas about what could be happening.

Probably worth mentioning, the screen has been broken (cracked) for 10 months and it's been working fine, these issues only surfaced yesterday after getting it back from repair.

Thanks.

Andy