In reply to FesteringSore:
It's just malware. There's no person attached to it, no one 'getting into her account', it's just a script.
Run malwarebytes on her machine and change her password from a different computer, will fix the problem easily. Unless she's using something like outlook express in which case all you can do is spam malwarebytes every couple weeks and hope for the best.
Post edited at 09:51