Perhaps her account credentials were compromised? Somebody could have used the web API to run a spam/abuse campaign.