So exGF took a topless pic of herself and sent it to your DS.
Your DH has seen this pic, as has at least one of DS' friends - this is not in doubt.
At the moment, there is no proof that your DS shared the photo electronically, although (it is likely) he may have told his friends about it and shown it to them.
The school haven't contacted you.
At this point I wouldn't reply to the mum. If the police become involved, exGF will be in as much trouble as your son, as it was she who sent the picture.
Unless someone else comes forward with a copy of this picture on their phone, sent to them by your son, they'll probably both just get a bollocking from the police and told not to be so fucking stupid in future.
However I'd be having strong words with my son about his friend "accidentally" seeing this photo after he "borrowed his phone for something", as quite frankly, knowing what my 16 year old is like with his phone, that's bullshit and it's pretty obvious that your son did show at least this one friend the picture.