Very doubtful that any e-mailing had been going on - Outlook express was totally empty - I had to configure it and set up her account. There was evidence of internet activity - earthlink toolbar, etc.
I did not take time to peep in the cache before I dumped it.
Just curious about whether simply being connected through a cable modem can infect. It had found maybe 50 instances of virus after about an hour of scanning, when I left
If she had any malware installed on her system, then all it takes is to be connected. You should check what programs are running at startup if you continue to get infections after running your AV. You should also download Malwarebytes and run that.
Did you check browser history/download history?
You don’t necessarily need a local email client like OE; someone could have been using a webmail....