There are 3 simple points that play into effect here:
Apple iMessage/Messages uses the data network, which could include wifi, but unless the neighbor has the Apple ID for your client, he could not retrieve that message. iMessage uses some hefty encryption that I HIGHLY doubt the neighbor could intercept and decrypt. Read more about this here.
Text messaging, or SMS, operates through the SS7 protocol. This is signaling messaging used for voice calls. As a result of this, SMS are not transmitted via the data network unless their specific carrier implemented it via their 4G cellular data networks. Since you stated he has an iPhone 4, it is NON-LTE and means it would use the traditional voice network radios to send and receive text messages. If the neighbor had a high-powered cell tower spoofer, he could listen in to the RF chatter, but without cryptographic keys from elements a few hops up, he would not be able to decrypt or read the messages. This would not be the case either as the complaint is that the client sent a message that he saw on the neighbors. This, in turn, would require the neighbor to spoof his MIN (Mobile Identification Number, not the phone number), to that of the clients mother, register with the mobile voice network with a successful A-Key authentication, which would need to be taken off the mothers device or the carrier regenerate and provide to the neighbor, and then receive the text message, all before the mothers device renegotiates with the HLR/VLR.
Lastly, iOS does not have ANY support for SMS API's. This means, you cannot intercept, block, read, send or alike from a 3rd-party app. Android on the other hand, allows full-transparency into the SMS stack.
From what you described, I highly doubt your client has been hacked/attacked, etc.
Other than the obvious, if he is paranoid, Disable Broadcasting the SSID, use WPA2, and choose a COMMONLY used frequency in the area. This would make channel hoping and snooping for your clients MAC address difficult. In turn, you can thwart a man-in-the-middle attack known as ARP-poisoning and MAC-spoofing.
If your client is still paranoid, I would suggest also enforcing AP Isolation, which will prevent devices on the same Wireless LAN from communicating together unless explicitly allowed.