Well, I know I'll never complain about having to show ID or swipe a card!
Since I know how he booked (phone), I'm pretty sure my HH account/password was never compromised, although I changed my password and credit cards just in case. So he couldn't have a digital key (since he couldn't log on via the app without my password.)
I'm leaning towards a local, who got my name/number from someone who worked at the hotel, and booked a room for a week to see what he could get away with... don't want to even think about what purposes he could have used the room for.