PP accounts are associated to the email address as you are probably aware. The culprit probably got the address from somewhere else. It's possible. Just a thought. In any case, my experience with PP has been a good one. It takes a bit of time but they will refund her after the investigation.
WPA2 hack: How secure is your Wi-Fi?