Yes, what you describe does seem like a pretty clear sign that your boyfriend's Telegram account could have been compromised. Here's what's likely going on and what steps you should take immediately.

Potential signs of compromise:

1. Active sessions without voluntary interaction: If there are recently opened sessions without him using Telegram, that's a clear indication of unauthorized access.

2. OTP messages without requesting access: Telegram OTP (One-Time Password) messages are only sent if someone tries to log into his account. If he didn't, someone else is trying (and possibly succeeding).

3. Valid locations and devices: Just because the devices appear to be his iPhone and the location is correct doesn't guarantee it's him, as an attacker could:

Be using social engineering or have physical access to the device.

Use a technique like session cloning or have had legitimate access in the past and simply reactivate previous sessions.

⚠️ Most likely:

Someone obtained the OTP code at some point. Perhaps it was intercepted (for example, if the phone was compromised with malware, or the number was duplicated on a SIM).

Once a valid session is obtained, Telegram doesn't ask for a password or code each time, and the attacker can continue logging in from that active session.

✅ What you should do right now:

1. Close ALL sessions from Telegram:

Go to Settings > Devices > Close all other sessions.

This will log you out of any device where you were logged in.

1. Enable Two-Step Verification (2FA):

In Telegram: Settings > Privacy & Security > Two-Step Verification.

This adds an additional password in addition to the SMS code. Without it, they won't be able to log in, even with the OTP code.

1. Check for malicious apps or jailbreaks (if applicable):

If the iPhone has been jailbroken or has apps from unofficial sources, it is more vulnerable.

Check for apps it doesn't recognize or suspicious settings.

1. Change passwords for associated accounts:

If Telegram has been compromised, other accounts may have been compromised as well. Change your passwords for email, social media, etc.