She already got in touch with paypal and her account is currently blocked (at her request). The tough thing is that ebay (at least in my experience) reacts to problems like this:
Me: there’s a problem. Here it is: [info].
Ebay: what problem? Meanwhile, here’s a bunch of random shit.
Me: please read the original email. I do not have a problem with my url proxy settings. I have a problem with [info].
Ebay: there’s no problem! See, look here, where we changed the information! See? HEY! LOOK OVER THERE! ::RUNS AWAY::
She’s emailed all the relevant folks she could find. She’s got the contact information for the person she thinks did this (when you ask ebay to change your contact email address, they tell you what it’s been changed to. She did a directory listing or something to find out who it is. So she’s got the person, she’s just a mite afraid to do anything about it because this person could quite literally do whatever the hell he wants with her accounts).