Neither did i know that it was possible, but now it seems it is. If you suspect it, ask him if he gave it to somebody else, if he did just change it, second thought, change it now and you wont have to worry about some stranger that have got your rcon.
Since he stole the server.cfg file.. he will host the same server as yours, look for it, if he is hosting with your cfg file the chances are good that you'll find it. Good luck.
Error is our enemy!