First check all his credit reports, and see if there are any other addresses or accounts that look unfamiliar (wouldn't hurt for you to do the same). If yes, he needs to tell them there's been fraud. The police report might come in handy for this. Regardless what he finds, freeze his credit with the 3 agencies: Equifax, Transunion, Experian. Pretty sure they'll do it for free if he reports suspicious activity, but a small fee for peace-of-mind otherwise. That stops accounts being opened in his name. He'll have the ability to temporarily lift the freeze if he wants to get a credit card or a mortgage, etc. He can lift the freezes entirely if he eventually decides they're unnecessary.
There's more than one way to get someone's information; the new job might've just been a coincidence. If you're not 100% positive that your mail is secure, get a P.O. box and have everything sent there.