Well, at least she got an email. I've come across many services that don't send an email to the old address when personal info is changed. Then you may have no idea you've been hijacked until after significant damage has been done.

Someone hijacked my Hulu account and I didn't notice until I couldn't log in on my Kindle because I hadn't been to my "home" network in a month, even though I was in my house. Fortunately they hadn't changed any of my details, and I got a refund for all the services the hijackers had added.

My friend's Rockstar Games Social Club account was hijacked in a similar fashion, he didn't realize the change because the email was in Russian.

Conozco ese lamento