My advice - and maybe I'm in the minority - would actually be not to say anything yet.
If you question him tomorrow based on what you've got, he can just say that it's nothing, there's no flirty messages, it's a work colleague, she came up on his suggested friends and he had a look. Nothing you can disprove, all loads of excuses.
In my past experience, if he wants to talk to this woman, he will. But if you question him about it he'll just hide it better. If he doesn't suspect you of checking his phone, then I'd just check it again soon and see if the messages continue/get worse.
Then if they do, you actually have something to challenge him with.
As soon as he knows you've looked at his phone he will start being more careful about where he leaves it and what's on it. He'll start deleting messages and taking his phone with him to shower.
I really would take advantage of the fact he's leaving his phone lying around and then wait and see what happens. If her messages start getting worse and she's blatantly hitting on him - he's got the opportunity to shut her down. If he doesn't shut her down, or if the flirtation is reciprocated, then you have something to speak with him about.
It's a really horrible situation OP I've been there and I hope you're okay xxx