Sorry, should’ve mentioned the password has been changed and the account has been logged out on all devices. Just wanted to know if there’s anything that can be done legally. I mean because of the massive invasion of privacy for the past 10 months
I don't think that there is, unless he uses her information, and even then, that would be dependent on how he uses it.
For example, if he used information he had access to engage in identity theft, that would be something that could be addressed. The level of identity theft, and the degree of malice could be a factor, as would what, if any, monetary damages there were.
If there happen to be photos of either of you in *ahem* a compromising way and he starts sharing them, that would be something that could be addressed. Depending on... how compromising.
If he's considering reposting things that would merely be socially awkward for your gf, then she just has to weather that storm.
If, having this avenue cut off, he goes on to actively stalking, that's another story.