If he denies that he sent the messages, or says he sent messages but the content has been altered where could the employer go then? "She's trying to get me sacked because ...". Where could you go from there to prove he committed an offense against propriety/policy?
Also, a perhaps more realistic issue is the move to WhatsApp could be seen as a move to personal interaction away from business interaction - if the employee alleged to have committed sexual harassment called her a milf once in a private conversation that was not a work context do they deserve to be fired?
Did he stop when asked, doesn't that mean it's not harassment? Still could be inappropriate and ultimate lead to firing but to me harassment is an ongoing series of incidents.