In all the theories about how someone could have hacked Jeff's phone — Saudi Arabia, the NSA, sophisticated phone hacking software — there are a couple of simple explanations.
For example, a search for his gf exposes a couple of her email addresses. If you then search one of the vast public data dumps like Collection #1, you can get passwords she used with those email addresses. If she is like most consumers, she re-used her passwords on several sites.
There is apparently a large hacker underground that specializes in hacking celebrity accounts in ways like that, presumably to sell what they find to publications like the Enquirer.