Most of the time, when someone claims they got into your computer, it's a scam.
However, if you have Remote Desktop access enabled, and someone is able to remote in to your computer, they can do everything that you could do sitting in front of the screen. That includes opening files, sending emails, and copying personal information. However, they can't do anything that triggers a password request (like install new software) unless they know the password.
