It would be more helpful if she uploaded screenshots of the emails, including the sending address, and pictures of the letterhead. Assuming she's telling the truth about everything this would be by far the most elaborate phishing attack I've ever seen.