Actually, that was the first thing I thought of - that he'd gotten into her email account, that is. We're not supposed to use the same password for multiple sites and such, but I think most average people do... and some places don't have a "three attempts and 15 minute lockout" block against someone running a dictionary against a username to crack the login.

The first thing she should do after running anti-malware programs is make a new email address and change all of her passwords (using very different ones) and website email contacts to the new one. And of course disable as much personal information-sharing as possible on all those sites so that there's never a reference to email, real name, etc. Ultimately, it may be necessary to change her phone number as well.