Are the statistics fishy?
The statistics (STR: 15) (DEX: 17) (CON:16) (INT: 14) (WIS: 14) (CHA: 16) sum up to 92. Let's assume the typical human +2/+1 and we are at a rolled sum of 89. Divided by 6, the average rolled number would be 14.83. Let's call that a 15. The actual rolls that were involved were most likely a spread of 15, 15, 14, 14, and 16, unless the race deviates from the typical +2/+1.
A spread like that does raise an eyebrow, as it is well above the average of the standard 4d6 drop lowest and is quite more likely to happen if you forget to drop the lowest die, as anydice shows. But it can also be an exceptionally lucky roll.
In fact, the likelihood of a sum of exactly 89 is 0.43%, 89 or more is 1.21% by treating it as the sum of 6 dice that have the probability of a 4d6-drop-lowest. This means, 1 in 232 has exactly an 89, but 1 in 82 characters is 89 or better.
Treating the Array as the target to roll, the chance is 0.66% to get exactly that array or 4.37% to get that or a better result. While the methodology here differs, the outcome of both ways is, that this array is not very likely, but not impossible.
It might have been luck - I have seen a roll streak of exactly 1-1-2 on the very same d20 which has a chance of 0.0125% to occur. Or in other words: Just because an event is unlikely, it's not cheating. Only if the event is impossible, statistics can indicate cheating. E.g. there is no way to roll any statistic greater than 18 or to get more than 108 points in sum. Only that could prove cheating. Just because it's unlikely that that specific player has the event does not make the reason for it cheating.
In fact, let's take a different example: a specific Super-Rare card in Magic the Gathering has a chance of about 0.83% to show up in a booster pack. It's exceptional if you draw the one card you want on the first try. But if 200 people each open a booster, it's very likely that one or two will draw this specific card. If you have 1000 players drawing cards, you'd expect about 8 of these cards to show up, but you might see none or 10.
It's not an alternate charge method
In a related fashion, it is clearly not the standard spread of 15, 14, 13, 12, 10, 8 that made the statistics. Neither can the point buy method create the array, as you can't generate a 16 with point buy. The other 5 statistics but the 16 already sum up to 32 buy points while you have only 27, so the spread isn't possible due to two reasons with Point Buy method. Both those alternate rules can be found in the 5th Edition Player Handbook p.14.
If you absolutely must talk carefully to the player.
When you see something that you absolutely believe to be fishy, you ought to talk about it. But still, they could just have had super lucky dice that day. Because statistics only average out in large numbers, e.g. generation 100 scores, they can't prove someone cheated. generating 6 stats is totally able to create the outlier to up or down.
While you expect that a created character using 4d6-drop-lowest has a sum of statistics around a mean of 73.47 with a standard deviation area of 66.5 to 80.44, an 89 is not impossible but just very unlikely (about half a percent either way) to happen on your table. But it does happen. In any way, if you feel like you have to talk to them, don't accuse them of cheating. They just could have been lucky, and an accusation of cheating will make them defensive or leave the group instantly.
I believe you should only talk to them about their statistics being quite better than the other players' characters, not about anything being fishy about the roll itself. You don't know the roll or the circumstances, but only the outcome, which is statistically possible so you can't argue that it can't be. The chance might be low, but it exists and is possible One player of about 200 will get a roll like that. If your player is taking a comment about the character being well above average with humor (I know I did once), they might suggest rerolling on their own, or show you their lucky dice (both of which were what I did when a GM gave me some similar comment).
As a GM, you have to read their social queues to figure out if you can trust whatever result you get from a player. In general, I run with the benefit of the doubt. That means if there is nothing obviously wrong in the reaction or result of a roll (here: they admit that they doctored the array, or another player points out cheating), deal with the better character statistics/good roll and the problem that poses for the game (usually: few to none), and don't treat the player as a problem unless they are known as a cheat. If it's a known cheat... well, there's open rolling and tossing from the table.
Prevent the problem in the first place and switch to a re-calculable method
Point Buy and Standard Spread are much easier to verify that nothing is afoot, every player gets the same resources. Especially for online play where characters are made off the table and there is no verification method for dice, it might be warranted to swap to either of those methods.
When I ran a campaign where players could drop in and out, the requirements to play on a day were made clear well in advance:
- Point Buy, 27 points, the original spread has to be denoted on the sheet.
- When you missed sessions, Level up to the party's XP pool pinned on the discord before you join in.
- Bring your own books.
As a result, I could at any moment check statistics that appeared fishy with a simple look into my own book and the back side of the sheet, no matter the current level.