You're correct!
   Yes, it's “who.”
     “His mother said a strange man who she believes may be the killer started sneaking her son toys on the day Ryan's body was discovered.”

     When you inserted “he” or “him” into the sentence after “she believes,” you get “he”:
     “. . .she believes (he) may be the killer . . . .”
     You'd never say “she believes him may be the killer.” 
     It has to be “he” — so it's “who.”
     Interjections such as“she believes" often throw writers and editors off, as it obviously did in this case.
     Important:When the above is not absolutely clear, you always should apply the rule about every verb with a tense having to have a subject. (You should always apply this rule because it supercedes all others withthe “who/whom” question.) In this case, it leads you to “who.” Taking them in order:

  • “His mother” is the subject of “said.”
  • “She” is the subject of “believes.”
  • (He) is the subject of “may be the killer.”
  • (He) is the subject of “started sneaking.”
        Gee, ain't this easy!  If you follow these two rules, which take only a few seconds to apply, you'll never get it wrong. But, when you do find a sentence that's still a struggle after you've applied the two rules above, go to Rule #3:
     If it takes more than a 30 seconds to figure it out, pick one that sounds best and move on.