Sart with the facts and work from there.
If the ex showed someone a copy of their online bank statement then they did it in one of two ways - 1) they already knew the password, 2) they didn't know the password but subsequently obtained it without permission. Or, alternatively they took a photocopy before they became the ex . . .
If 1) above then change the password as soon as you can. If needs be, ring the bank and request assistance in changing. Doesn't matter whether it was the ex or some person in some foreign country, or whoever . . . if you have concerns about the status of a password (or credentials, whether password or otherwise) then change it.
If 2) above then I'm sure there are a raft of rules/laws which have been broken to do this. If there is evidence then this is a very serious issue indeed. However, establishing the evidence is the hard part.
On the email front - change passwords. If this person has (say) an eircom.net account and the ex claims to have access to the usernames and passwords then this *again* is a serious matter and the IT Security people in eircom should be approached. It's possible the ex is supposed to have access (say, because he is an administrator) then there is still the pretty clear cut point that they shouldn't be using those credentials. It's like someone in a bank - they have to know your account number in the course of your work but they don't go about using your account.
z