Well since he initially set up the account, he made my password. But I changed it the second he gave it to me.
But if he can still get into my account somehow, then yeah he can track my iPhone, and me with it. It's one of the MobileMe features.
Thanks for the response 🙂