Could microsoft remote desktop connection be used to spy?
I'm pretty sure it can get installed as part of Office, as well as separately.
One app not to worry about, in fact - as it can only be used to 'dial out' to a Windows machine, not another Mac.