If really someone had access to your wallet, I think they would have wiped out your wallet dry...and just for the sake of getting to the bottom of this, counter check with the addresses shared/linked to your wallet incase you have invoices that came through to your email address and paid off.. Sometimes we might tend to forget these things as it's part of being human, but just incase do check, good luck.
No one is above and that is what we should always remember when we make a mistake, a BTC in the wallet can not be touched if the owner did not touch it or give out his seed phrase and the wallet gets hacked, with his explanation I think he didn't do anything wrong with the transaction he made but it seems like his is doubting something because the BTC in his wallet I have decrease which shows that someone might have access to it or the wallet got hack, from my observation I don't think someone has access to his wallet because although BTC can not be decreased without not touch, well if that will be the case I advise to change the wallet immediately or withdraw all the coin from the wallet to another wallet before it gets worst but I'm still thinking that if the account was a hack I don't think he will still find some coin in his wallet, the person who has access to his wallet will have to withdraw everything instead of making the transaction until he has noticed.