PP accounts are associated to the email address as you are probably aware. The culprit probably got the address from somewhere else. It's possible. Just a thought. In any case, my experience with PP has been a good one. It takes a bit of time but they will refund her after the investigation.
What is ransomware and how do I protect my PC from Petya?