Depends on where you are, because the law is different everywhere, but in some jurisdictions threats are legally actionable, so if the police aren't taking them seriously, you can get a lawyer involved to add leverage, or even report the problem upstream to whomever oversees the police in your location.
If the threat isn't actionable, all you can do is work to track and block whoever this is from having access. Your comments so far suggest a primary concern over your girlfriend's system being the culprit's access point, but a forensic analysis of all your devices would be wise.
One thing you should be careful of is to NOT move data around between devices. Keeping everything isolated so you're not sharing emails, texts, documents, browser trails etc will make it easier to spot the access point. You can even test this to some degree once everything is isolated, by using each device to separately send something like a false email to an existing address. In each case, make the email about a different subject, and use a new recipient address you set up, so this person can't already have access to it.
Then you watch for any references in threats or texts to anything specific to any of the messages - which one tells you which device it came from, thus which the person has access to.
Ultimately though, going totally dark - pulling all your devices out of service and powering them off, including your router and wifi so there is nothing for the attacker to monitor is the only sure action you can take to halt access.
Personally, I'd do that, and in the process find a local computer store that offers malware detection and cleanup, and hand everything over to them to examine.
