Since she is able to invite him over, I assume you don't live together.
Before moving to how to confront, noted that since you were told, the question still is how did the friend find out?
Based on the information you obtained, you already did confront her prematurely (other words without solid proof).
BTDT, worst mistake you can do it allows for her to deny anything happened. Oh well, live and learn.
Since she denied anything physical happened (based on your post), the fact she didn't deny that he did come over means the mutual friend did know something.
The question again is how did he find out. So unless another person was there on this particular night, one or both of them told or showed one of your inner circle friends something.
Otherwise how did it leak out.
First question to her: Who did you tell and when?
If she says no one, then she's either lying or your friend is bragging to one of your inner circle friends. If a guy is going over to his friend's GF house, do you think if he got shutdown he would brag about it.
The thing is other people know, and these so-called friends kept it a secret (ONLY to YOU). At some point your friend heard about it or he's known for up to a year when it happened.
Next Question of act: Go see her and ask her to pull up her call history on-line or request 1 year of bills.
The traffic should mostly be between you and her girlfriends/family. It should not really include his number.
Do you have a laptop? Does she have an apple phone? Download ITUNES on your laptop. Android: DL Smart switch.
Download Dr. Fone by Wonder_______ Do a search for it.
Run the software on your phone for practice.
To note get a copy/backup of her phone. Don't let her do a factory reset. Under Dr. Fone you will if she has deleted the messages, what has not been over written will be under UNKNOWN.
If messages between them are there will be under their name. Watch out, his number can be hidden under a false ID Name. Search for his phone number.
The fact if she won't give up her phone or let you see her facebook messages is good enough.
ONLY Do this last one if you really think you need to:
Get a VAR put a cheap earbud on it and cut off the earbuds (it silences the beeps) leave it where she would talk if you weren't there.
After you leave, she will call him or her BFF to complain that you know more than you should. After 2 hrs come back, and retrieve it don't let her see you take it.
Know this you're not married to her, this is not a court of law, it you're getting a bad vibe that she's lying to you, then get out.
Find someone else, I know this is harder than it sounds but committing to someone who has poor relationship boundaries doesn't get better after Marriage and kids. The fact she allowed this (and not leaving out your STBX friend) should tell your gut to get out.