Why go through the exercise of asking how is he doing it, how is it possible, how anything. He obviously was up to no good in some way while a guest in your house. He found a vulnerability and the methods are not necessary to know since he can now be thwarted.
Change your passwords for accounts he might have looked to use without permission. Don't make the new passwords very similar to the old ones like just adding a 1. Make up a very unique and more sturdy password he can't guess or he might take a few stabs at.
especially change passwords on financial accounts as well as email accounts.
Don't let him enter your home as a guest under any circumstances. You can tell him he is not welcome there, but if you want to maintain a relationship do so without him ever having access to your computer or cell phone.
I wouldn't dwell on how or why if it just takes a few minutes of effort to prevent his intrusion and end whatever he is up to. He's not trustworthy and you have the power to stop his shenanigans and maintain your security.