To confirm that the address is actually in your wallet... In the "Ledger Wallet Bitcoin" chrome app, click "Settings -> Tools -> Sign Message"... then click the little "v" symbol at the end of the "Address"... you'll get a little search box pop-up... start typing the first four or five characters of the address you want to check, you should be able to see the full address displayed in the list.
If it says "No results match xxxx" then you have a problem.
Additionally, you should notice that in the transaction history displayed on the "Ledger Wallet Bitcoin" dashboard, that the transaction will display as an amount of -3 BTC (plus transaction fee)... not -5 BTC.
He can do that and confirm that this address actually belongs to his wallet, but the easiest way is just to check final balance of the wallet. If he misses 2
BTC in the balance then he is hacked (which is unlikely). OP just have problem in figuring out how things are working, change address is part of his wallet, not some another imaginary wallet. However this change address bug should be solved long time ago, old firmware or it still exists?