Yes, he definitely crossed the line! Why are people expecting that the boyfriend has more responsibility than she does to get him to stop, though? It sounds like they both said one thing to him, but didn't follow up. We talk a lot about how women have trouble speaking up, and trouble with conflict--some guys can have that problem too. And really, I'd rather a guy inclined to back off than one inclined to jump in and start threatening the guy. Sure, it would've been ideal for both of them to be able to tell him to back off firmly in a way he would listen to, but *lots* of people lack those skills.
And I wouldn't be that thrilled at my boyfriend "taking the bait," perhaps. Maybe a fight is what this guy wanted. And, from years of living in NYC, I don't want the confrontation; I don't want to win; I want to be free of the situation--not just in the moment, but in mindshare. So I prefer the solution that has the shortest mental and emotional repercussions *for me*.
At the very least, I'd report him, even after the fact. Even now, today. Make a call to the manager.
(It might help you stop stewing about it, and feeling angry and powerless--see "shortest mental and emotional repercussions," above. Taking action, even belatedly, might make you feel less agitated.)
I think the "Your comments aren't welcome" response is good. But if you can't think of it, or don't think it would do any good (I don't think it would have), my suggestion would be to make a beeline for the front desk and say, "This guy is saying this creepy stuff. I want you to do something about it."
And I also, from years of living in NYC, am not above going "to the next subway car" to avoid someone like this.