You can also set the permissions on photo folders or even individual photos so just friends, or even just family or certain people can view them. Pretty simple to do.
She claims to have done that. If she really did, that raises a disturbing possibility.
#6 and 10: Then Facebook changes the permissions as they have done time and again. Once the photos are out there they are out there.