Unfortunately, if it was addressed to him, he would have opened it up, and once realising that it wasn't something he bought, he would either keep it or return it to the sender (if the sender didn't nominate that it was to be abandoned if undeliverable, as it could have incurred a cost to send it back). If there was no indication as to who bought the item, and IF he actually asked the post office about returning it but found it would cost him money to do so (once it was opened), he may have been stuck with it (if there was no contact email for the seller in the package).

If it happened to me, and something arrived with my name on it without any contact email or any idea who bought it, I would ask the post office if it can be returned free, and if not, I would hold it for a few months to see if anyone I knew mentioned it or contacted me about it. After that, there's not really anything to do... and I wouldn't just throw it out.
It's unfortunate that these vintage Gen1 toys have ended up in the hands of kids, further shrinking the pool of mint or good condition figures, but at least if he exhausted all options, the toys went to 'a good home' instead of just being discarded in the trash.

As for the GF... she should have changed the settings back, if being allowed to use someone else's account (yours).