Stolen MacBook running Windows via Boot Camp
You didn’t provide enough detail to adequately address the actual problem (I.e MacBook model, version of Win10, was it unlocked/unencrypted, etc ),  so we must look at this from the worst case scenario:

Once a device is physically in the possession of nefarious parties, you must assume the entire system is compromised. 
Guessing what the risk is at this point is an exercise in wishful thinking.  

This is where you advise your friend to start securing accounts (change passwords, add two factor authentication, etc.)