My husband and I were just at Atocha a few weeks ago and you don't need to worry or change anything because of security. They do scan the bags but not your body. And they do NOT check IDs. We had e-tickets ordered off of the Petrabax website (recommended by Rick Steves AND me) and they have a barcode that gets scanned but that's it.
It is wise for your husband to have a money belt and to keep passports in there and with you at all times, but you sure don't need to show them to get on the train.
In regard to the Madrid Airport, yes, of course, you will need to show passports there.
In regard to thieves, we did not experience the problems we had anticipated and prepared for by my husband and I each wearing money belts. (FYI, we do that in every foreign country.) Years ago I got robbed in Paris and lost everything so, after that, we started wearing belts.
We didn't experience any threatening situations per se, but I would caution you to not accept help from strangers. We did have a group of 3 young men come up to us at the train station and offer to help us with the ticket machine. We have had similar situations in other countries and it is generally a scam; they are hoping to get your card or at least the number. So I would just caution you that if some "Good Samaritan" appears out of the blue, to just thank them politely but tell them you're fine. (And get whatever help you need from a ticket teller rather than machine. That's what we did.)
Madrid is wonderful; the trains are wonderful; have fun.