If he has used the school email or postal address then his actions would almost certainly breach his contract and professional standards.
Other than that he hasn't broken any enforceable rules - the 5 year guidance is more about protecting teachers than ex pupils.
Many of us stay in touch with numerous ex pupils post A level for any number of legitimate reasons, or just to keep in touch.
But this is different because she is running a business, and he is buying her service (content) they are not in touch as such, or carrying on a relationship.
Its no different in essence to my former pupil being my boiler guy, I use his services as a gas engineer, I'm not a friend or social contact - different kind of business of course, but both are perfectly legal.
However, if he has used, as I previously said the schools email address in his registration, that's a sackable offence because it is linking the schools IT to adult material, and regardless of whether that is legal adult material it is still strictly forbidden.
So, there may be a cause for concern. She can legitimately contact the school IT department and advise of her concern, as she has a duty, as a producer of adult content to ensure, as is reasonably practical that minors can't get access. that would not be a GDPR breach IMHO.