Generally speaking an investigation on an alleged cheater can go in three directions:
1. Technical issues outside Moodle
Typically, network issues or the
server overloaded. Theoretically incompatible browsers may also play a role, but if the students use the latest version of a mainstream browser, less likely.
2. The quiz is not optimally set
There are simply too many setting in the Moodle quiz/questions module. It needs a lot of practice.
3. The student has indeed found a hole
On 1), your system administrators and network administrators must talk. They should have deep monitoring in place whose records they or experts can study after an incidence.
On 2), I would analyze the two quizzes in detail. Certain statements you made, make me think that this is viable.
Example 1. " the teacher asked us (the invigilators) to do the initial calculations of multiple choice questions". Why, Moodle has a sophisticated grade book built in.
Example 2. "However, the student had re-entered the exam, after they have left the room." I assume, you don't want that. Then how was it possible? You must have missed a setting. Strictly speaking, Moodle may have a bug. But I can't imaging it having such a glaring bug, the quiz module is used intensively all over the world. Even if there is one, you must document a way for us to reproduce the behaviour.
On 3), that is also viable. There are always ingenious students - or at a minimum, they just need the resources to surprise the teacher/invigilators.
As Tim already stated, you can't be 100% certain in a passed incidence, not even 99.9%. You'll have better chances in a human engineering approach, if you could make him to talk somehow...
Not joking. Don't underestimate the value of a confession. You'll save an unknown number of future incidents.