The issue may also be that her Yahoo account is compromised hence the hacker also sees the changes in the password. also ask her to use a unique password not used on any other service in the internet. 

If she is on an unsecured wireless network, she may be a victim of Firesheep (http://www.h-online.com/open/news/item/Firefox-extension-steals-Facebook-Twitter-etc-sessions-1124596.html) which can be detected with Blacksheep (http://www.h-online.com/security/news/item/Firesheep-cookie-jacking-tool-triggers-arms-race-1132915.html