Do you know when she contacted the recovery team ? From memory, it took about 15 days to get a reply, but it may take longer now.
About 17 days ago.. She told that she had gotten a first response, (If it was not an automatic reply) must ask her about that!
It's a shame she didn't react sooner, she could have noticed anomalies in her
IP addresses. The most important thing is that she makes sure she has cleaned her PC, because she could lose much more than a forum account.
At first sight, she just tried to reset the password via security question and then got account locked!! (Hope it is just that)

N' that's believing the security reports, as an attacker should have changed the password that should have been reported on the Sec Logs! Or no ?
