I've passed the IP address and login times (from the Facebook alerts) to Sky abuse. They might be interested I suppose, as it's a PC using a Sky address. Took a second look at the alerts and it's definitely her email that was compromised (login was via a code + her email address). Hopefully all fixed now.