She probably registered to a forum or the other portal and she used her email with the same gmail password. And then the data (list of emails and passwords) form a forum/portal leaked. Ask her if she use the one password to all accounts.