PP accounts are associated to the email address as you are probably aware. The culprit probably got the address from somewhere else. It's possible. Just a thought. In any case, my experience with PP has been a good one. It takes a bit of time but they will refund her after the investigation.
Microsoft Surface Pro 4 review: Hands-on with the new generation of Surface