Well the safe option should have had you add a password, fingerprint, or other means required to open and access the data. So if that was turned on, while there is no way to 100% say no one could hack it, it is safer than if you just had them on the device. Unless you had an app on the phone that can remotely wipe it, there is nothing you can do with the files and apps on it. In regard to motherboard and IMEI, they wouldn't need to change that to use the phone. They would just need their own SIM.
What I would do is one, contact your carrier/service provider and have them cut the service to the device, and two, report it to the police.
Oh and three, log into any account you had accessed from that other phone and change all your passwords.