[General Questions and Answers] Droidriven:
I mean any recovery type (TWRP/CWM/Philz) and any recovery version(the number versions, e.g. X.X.X.X).

You just need the correct number version of recovery to flash the ROM version(KK, LP, MM) you'll be using.

Usually porting between ROM versions(5.0.2 to 5.1.1) doesn't go so well, its rather difficult even for those that know how to do it(usually isn't attempted even by experienced users) someone new to it will REALLY have a hard time or probably won't be able to do it all without causing damage when flashing it.

A simple Google search for:

"How to port custom recovery for MTK6582"

Or

"Automatic porting tool for MTK(or MTK6582)"

Should find what you need

Another simple Google search for:

"How to port ROMs for MTK6582"

Or

"How to port 5.0.2 to 5.1.1 for MTK6582"

Should find what you need to port ROMs.

I don't have time to find you links right now because my nephew's girlfriend is in labor having a baby, but I can at least help point you in the right direction.

---------- Post added at 06:12 AM ---------- Previous post was at 05:20 AM ----------

Welcome to the community.

Those random downloads could have downloaded anywhere, not just to your download folder. It could have downloaded to your system partition(if it went to system then factory reset or using Clean master as suggested won't work) or even to the app data folder(android folder) for one of your apps. It could even be an automatic update to the ROM you flashed if that ROM uses an automatic update service(I doubt it), in that case you MIGHT be safe.

When you rooted, what did you use to root?

If you used Kingroot it's famous for installing extra(even malicious) software on your device and then collects data from your device and sends it to servers in China. Usually ANY Chinese software is very questionable, the Chinese are known for distributing software to hack a device unknowingly.

Did you both use the same method/software to root your devices? If so then you may have already been hacked.

If you have Kingroot as your root manager instead of SuperSU then you should convert to SuperSU by using the Supersu-me app to do the conversion for you or you can try flashing SuperSU.zip(not the app from Playstore) via your custom recovery like you do when flashing a ROM. Then you can just remove Kingroot.

Since you have custom recovery and you've flashed a custom ROM then I suggest you boot to recovery and do a factory reset/wipe data, wipe cache and wipe dalvik cache then find the advanced wipes to format system partition(formatting system completely removes your operating system just like formatting your hard drive on PC before doing an install of Windows) and data partition(this removes any downloaded content or anything you installed in the ROM, do not format any other partitions), then you can do an all new clean flash of your ROM and Gapps(do not reboot after doing the wipes, go directly to flashing ROM and Gapps because the device won't boot without an operating system, you removed it when the formatting was done)

This should remove anything that is not part of the ROM or Gapps and put you back at a clean start with nothing extra. If you still have Kingroot after flashing you need to convert to SuperSU as I stated already.

***NOTE***

Before doing any wipes/format or flashing the ROM you'll need to backup any personal data such as contacts/MMS if there are any messages you want to save, apps you personally downloaded and their app data, etc....

You can use Titanium Backup to save the data you want to keep(just be certain you aren't including any of the potentially malicious software that got downloaded). Then after getting everything clean flashed you restore the backup made by Titanium Backup.

As for the notification of a Google sign in, if someone had signed into either of your accounts it wouldn't have notified you that it was blocked, it would have asked if it was you and then asked if you wanted to block it and it wouldn't have started downloading any files(unless your husband is trying to spy on your device remotely which I'm not saying he is, I'm just trying to present all possible scenarios or unless he did at some point login on your phone using his gmail account, then it would be trying to install everything he had backed up to his Google account on his phone into your phone).

I hope all of that wasn't too much for you, if you don't understand then ask him to help you with it, if you both don't understand then you know where to find us.

---------- Post added at 06:20 AM ---------- Previous post was at 06:14 AM ----------

You can use Apktool to decompile the app, then modify the app, then recompile the app, then install the modified app.

That's the tool, you'll have to do some searching to find how to and what to do.