Her argument that it was 1 of 2 passwords don’t fly. that means 50% of the work is done. You have one, brute force the other. Happens all the time
A possible scenario is that she left the passwords up long enough for cheaters to get plenty of devices to receive the confirmation code.