If he has signed into hotel WiFi and his fiancée was within range of that, the phone and watch would remained connected over the WiFi network.

WRT claims that they used his fingerprint to unlock the watch, that isn’t supported, but if it were within range of a paired phone and put on a wrist, it would unlock when the phone is unlocked, potentially via Touch ID.

Edit: If I were to speculate (which is all any of us can do) I would guess that the latter is how they got access to the watch, and he and his fiancé had a family iCloud account, which the files automatically uploaded to via his phone.