I don't think talking to the friend will achieve much. As you say, he'll probably know, or guess, exactly what's happened. And if he already knows - or even if he doesn't - he'll probably cover for your husband, even if only by claiming to have forgotten.
And, as has been pointed out, the changed passwords are a big red flag and probably should be your principal concern.
But...you have his email passwords? All of his accounts? Does he use these emails for LinkedIn, AT & T, etc?
If you forget your password, many sites will let you reset it by sending you an email.
So, when you're ready to check up on him, perhaps you could use this option to reset at least the most crucial password back to what it was before. (You'd need to delete all the trace of the reset, of course.) Then go in and gather evidence immediately.
This would need to be a once-and-for all attempt. If you're very lucky, when his new password doesn't work he'll try the old one and simply think it was a glitch. But since he sounds pretty devious, he may well guess what's happened. And he'll almost certainly change his email passwords too, But by then perhaps you'll have the evidence you need.