You should have been receiving statements from your bank at least once a year. If your 'friend' has used the on-line banking facility to change the postal address, it is possible that he has used printed statements to obtain credit &/or credit cards under your name, as well as the possibilities of money laundering and, if his earnings have been in cash, tax evasion.
Not only would I have the account closed, but I would also request the bank to supply you with statements from the date you opened the account up to the current date, in order that you can ascertain the type, value and regularity of transactions that have been passed through your account.
You say that he 'borrowed' the card - have it cancelled with immediate effect! Do not give him any notice, it is your account that nominally contains your money. Send him a cheque, payable to him, drawn on the account for any money that is his and let him worry about how and where he is going to bank it.