If your Dad only uses a single AppleID (as most people do) and someone had/has the password for that AppleID, they can login to FaceTime, iMessage, iCloud, the App store - anywhere you use that AppleID and password.
With the password changed now, the thief should be locked out again.
It is vital to keep your AppleID password secure, since it is the key you use for any and every Apple service. Personally, I have 2-factor authentication set up on all my devices, but I also have 2-step verification set up on my AppleID as well, and if people wish to use both systems they can as they are not mutually exclusive.
P.S. They are also not the same thing and they each provide independent additional security - 2-step verification requires a code via find my iPhone push notification or SMS text each and every time you try to login to manage your AppleID at https://appleid.apple.com/ even if logging in from an already 2-factor authenticated/trusted device. 2-step verification replaces the security question aspect of AppleID security with a code (and a 14-digit master recovery code which must be kept secured somewhere as well in case it is ever needed).