I have a Moto E (4th generation) and some other miscellaneous handsets including a Moto E3 that I ordered on ebay for its battery, and a disgruntled, hostile acquaintance of mine recently ambushed me at home, letting himself in while I was sleeping, and demanding all of my technological equipment. He was embarrassed by some of his recent behavior and wanted to ensure that I wouldn't ever let anyone know of it so as to damage his reputation. He wanted to see all of the messages I've been sending to or receiving from any of our mutual acquaintances and have them deleted. Then he demanded the keys to my place and left with my phones to see his friend who is a smartphone repairman. He told him to wipe them when he phoned and gave the guy the green light to do so. Before he left with them he forced me to unlock it with my fingerprint and removed the screen lock in settings. After having a drive around town to/from his friend's shop, he seemed to have released some anger and was more himself, although this man has been slowly losing his sanity in the last few months since I've known him due to pressure of owing various people things and the stress of that.
Anyway, he returned and I asked him why he took away phones that hadn't even been on since I've known him, and he said to not worry as he'd changed his mind and wouldn't have his friend wipe anything. He went outside to speak to his friend on the phone and then left once again, returning with my devices. He said that none of them had been altered except for one from ebay that hadn't even been turned on by myself much less used to store personal data, which he already wiped. My main one with my whole life on it in the last few months, however, was unlocked when he delivered it to his friend and returned it to me, and he explained that he only had his friend delete the things that were related to him and our mutual acquaintances, which was indeed partially done. However, my E4+ has been behaving oddly since I got it back from him, frequently popping up messages that "Google Play Services is not responding", suggesting to me a relative shortage of RAM causing background processes to hang a bit, which seems likely to be caused by other background processes doing things on the phone that are running without my knowledge, thus consuming more RAM than before this all happened. Since the encounter he has been threatening to track me down, etc., and I thus wonder if there's any way to find out if the phone has had spyware (geolocation, etc) installed onto it. Obviously if there's a sufficiently advanced rootkit it may not be readily detectable, perhaps there are some clues that can be looked for, and further, I take solace in the fact that none of the characters involved are terribly sophisticated.
I will probably replace the phone soon, but at the moment my life is a bit hectic and it would just add stress, and further, due to some of the principal actors' financial situations, I believe that everything from compensating associates to transportation could prove challenging. The E4+ is unlocked but originally with Vodaphone utility apps bundled in and possible only to disable, but not remove. The E3, on the other hand is in a weird state as normal android apps like chrome don't appear in the app menu, and in about firmware, the phone says something like "buildslave". I might have disabled most of the stock apps when I first got it from ebay without remembering, just to prevent myself from using it and populating it with personal data, proliferating my life even further in case someone needed a phone and my others were dead, just to signify that it was only to be used for its battery, as that's the sort of thing I would do, but I did not install any alternative firmware builds. Anyway, I'll be back with the handset in a few hours and I'll be able to check any sort of diagnostic information that's needed.
PS If this is more relevant in security.stackexchange, please feel free to nominate it for moving to there.