It's possible to write an app that would record usage and that wouldn't show up on any scan.
It's also possible for him to get into her phone, whether it's pattern-locked (or password-locked) or not.
Sorry, but her only means of escape is probably escaping.