PP accounts are associated to the email address as you are probably aware. The culprit probably got the address from somewhere else. It's possible. Just a thought. In any case, my experience with PP has been a good one. It takes a bit of time but they will refund her after the investigation.
Surface Pro (2017) vs Surface Pro 4