Best I remember, there is one menu with "allow remote access" that enables the PC to function as
a telnet and ftp server, and there is another area where "allow remotes access" lets someone connect
to your computer via "remote desktop" and control the computer as though they were sitting in front
of it, usually for purposes of troubleshooting a problem or making changes the local person wants
someone else to do. It's fairly obvious when the latter is being done, as you will see the mouse
moving around, screens changing by "magic"
Neither one will allow a remote person to see what you are typing and viewing, at least not without
you being aware. However, anytime you turn on these types of services, there is potential that a person/virus, etc, could break or bypass the passwords associated with each and then indirectly
install utilities that do the things you are concerned about. However, it's common in business environments to have all three enabled ( telnet, ftp, and remote desktop ) This is because most
businesses are protected by a firewall which filters out unwanted inbound connections regardless
of whether they are enabled/disabled on each PC.
Windows firewall should still block unwanted inbound connections, assuming it is still on and hasn't
been modified to allow such. Also, if you have a DSL/cable router with firewall capability, it will do
same thing as windows firewall, but usually better.
Not sure I'd jump to any conclusion about your ex, as these can be enabled if the PC is setup in
a "server" configuration, and they can also be turned on by virus/malware.