If someone has access to my iCloud account, can they see all my text messages or just my iMessages?
To start off, as of August 2017, there is no way to view or send iMessages from the web. So before she could view your conversations, your friend would need to register one of her Apple devices with iMessage using your Apple ID.

When that happens, you will get a notification on all of your devices, informing you that some new device is now registered to use your Apple ID and phone number for iMessage.



Your friend will then be able to see all iMessages you send and receive. It doesn’t matter if you initiate conversations from your phone number or from your Apple ID. Not only will she be able to see everything, she can also impersonate you (by sending iMessages on your behalf, from both your phone number and Apple ID).

Regular text messages (SMS/MMS) work a bit differently. They are sent and received through your cellphone carrier, then forwarded from your iPhone to your other devices. Even if your friend registered her Apple device with iMessage using your Apple ID, you would still need to go into Settings → Messages → Text Message Forwarding and allow forwarding to her Apple device.

Currently, registering a new device for iMessage only allows that device to view new messages that are sent and received. However starting in iOS 11, with iCloud Messages, registering a new device will allow it to view all conversations synced to iCloud, past and future.

Text conversations are absolutely the least of your worries, however. Much more importantly, with your Apple ID password, your friend can login to iCloud.com and read your email, impersonate you by sending email on your behalf, use your email to change your password on other websites (and essentially login to any of your accounts, anywhere), view your photos synced to iCloud Photo Library, access your contacts and view their private information, etc.

In essence you’ve given her full access to your account, much of your private life, and private data belonging to your friends and family. In many ways, you’ve given her your identity.

Remember that arguments and falling-outs do happen, even among best friends. If/when that happens, she could also change the password on your iCloud account and steal it from you.

I strongly recommend you visit id.apple.com, and change your password immediately. Then remove any devices she may have registered with your Apple ID.

I’m just not sure how giving her your account password solves the problem where she forgot hers. What she needs to do is recover her own Apple ID.