Got a message on her phone (settings notification). She had to change her password through the settings app.

Called Apple just to check and they said they weren’t seeing any weird activity. That they did see the password was changed, but no weird login or attempted logins.

So, in my sample of 1, that wasn’t the case.