I'm not sure it's quite as simple as "if you don't want someone to access your phone, don't give them the password". She might have given the password for some other purpose (eg to access a laptop or log in to a particular website), and it was just coincidentally the same password she used to lock her phone. That may be naive and careless of her, but I think there would have to be some kind of specific consent for him to access her phone and read her messages. Whether it's breaking the law to do so, I don't know.
It may not be a legal analogue, but it sounds somewhat similar to giving a friend a spare key to your house in case of emergency, and the friend decides to enter the house at 4am and take photos of you sleeping.

Now, technically the entry wasn't unauthorised since you gave them the key willingly, but the action taken after entering wasn't authorised!