Figuratively. If they’re not going to properly sanitize it of malware, then it’s “hot” as in, “dangerously infected”. I would treat it as such and do nothing at all with the machine. I would go so far as to avoid the network to which it is connected.
Do not use an ISP email account. If she’s dedicated to privacy, the select a paid email provider and use that. I quite like FastMail and have been using them for years, for example, but both Google and Microsoft offer paid accounts.
You do not want ISP email, because if you change your ISP then you lose your email account. This is a terrible idea. Otherwise, I would try your local chamber of commerce. ISPs generally need to work with local governments to authorize them to provide services. Locate the ISPs that are available in that town, then contact each and determine if they meet the requirements.
Good luck finding a small ISP in a major area.