The issue may also be that her Yahoo account is compromised hence the hacker also sees the changes in the password. also ask her to use a unique password not used on any other service in the internet. 

If she is on an unsecured wireless network, she may be a victim of Firesheep (http://www.h-online.com/open/news/item/Firefox-extension-steals-Facebook-Twitter-etc-sessions-1124596.html) which can be detected with Blacksheep (http://www.h-online.com/security/news/item/Firesheep-cookie-jacking-tool-triggers-arms-race-1132915.html) 

_______________________________________________
Skunkworks mailing list
Skunkworks@lists.my.co.ke
http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks
------------
Skunkworks Rules
http://my.co.ke/phpbb/viewtopic.php?f=24&t=94
------------
Other services @ http://my.co.ke