If he didn't install it directly then you can assume it was installed by another app. Is there any indication over what period that 2GB was used? If so then the likely culprit is something that was installed around that time. It may have been part of some other security or privacy app that he knowingly installed, and if so, he needs to read-up on that software to know what it is doing.
VPN software is designed to funnel all internet traffic through it (hence the large usage), so unless it was installed for a reason, it should be uninstalled.
Ah, if he used the phone as a hot spot then x-vpn is probably part of the hotspot software. If he hasn't gone over his monthly limit you can test if x-vpn is part of the hot spot software by briefly turning hot spot again and seeing if data is recorded against x-vpn. Just make sure you don't do this if he's anywhere near his quota limit for the month (assuming he is on a monthly plan) because he won't be able to control how much data the tethered device will consume and there is no point risking excess data charges just for this test.