No clue as to the “how it happened” but change her PW; make it so you need a secondary way to authenticate it and call the credit card company to see if there was a charge for that PC and get the purchase cancelled if necessary.