A couple of days ago my mother-in-law asked me to look at her iPhone. She was confused to why pictures she did not shoot were on her device. I took at look at her iPhone and did indeed find pictures that she probably didn’t take herself.
Upon further questioning, she did state she previously lost a device and purchased a new phone. Both devices have photo backup enabled on iCloud. She obviously did not change her password and now the possessor of the lost device is synching to her iCloud account. She has since changed her password.
If you have an iPhone and back up your photos you should do two things. You need to change your password if you suspect suspicious behavior or actions. You need to also disable the geo location data from your camera so pictures you take cannot be located by latitude and longitude.