I would imagine that this is a human problem and not a technology problem. She has insight because she is probably seeing them relayed from another person or the device, but she is not hacking them. I think she would have to be pretty savvy technology wise to do this. Not out of the realm of possibility, but unlikely for the average user.
Good practice to have your phone password protected. Won't protect you from losing your phone, but won't put your data in someone else's hands.
Also, anything that is in print can be forwarded...be mindful of what you write. Works in business, why not here?
"out of chaos comes opportunity"