$100 says she sent it to herself.
I agree. It’s the only reasonable possibility, as neither the “employee did it” nor the “hacker” explanation make any sense.