Photos not taken on any of our devices showing up on my Photo Stream
If your son had the FindMyPhone app installed,  you should be able to go to iCloud.com, log in and find and erase (wipe) the device. If it ahas been some time, contact information, personal details, credit card info are all at risk. I suggest getting him to change all risky numbers. Perhaps notify contacts to look out for spam/rubbish/malware etc.