[daedalus_j]

My guess would be that their phone was taken from them, unlocked, and their messages were accessed that way.

I know several large IT orgs that have done this when Legal got involved. Literally using a 2nd phone to take pictures of Signal chats on the phone in question.

[nabakin]

Or some sort of spyware like Pegasus