Well, let’s face it, we don’t know when she set up her personal account. Mine was set up long ago, and has the same ease of being hacked. I haven’t reset ever, so I can understand that way back in 2008.
I can't believe I have to actually explain this. You simply, either, select different personal questions (ones where the answers aren't known or can be easily figured out), or you don't put people's actual/true names down, but rather just about anything else, even a random set of keyboard characters. Yahoo doesn't care if the answers are true or not. Then jot it down somewhere so you'll have it if ever needed.