Your best bet is to start with the bank and change your bank account - I know you wanted to avoid that, but this account is seriously compromised now - close the account and keep your ass covered. Your next stop is the police - she needs to be charged with theft/fraud.
I once had a bank account cleaned out by what I assumed was my rental agent at my apartment - they had a copy of my monthly cheque, complete with signature, and they knew how much money would be in my account and when. The bank was very helpful when I signed a sworn statement that the person who had withdrawn the money wasn’t me - she had forged my signature (but not very well - we could tell it wasn’t me, but close enough for a casual glance). Uh, I think I started this story with a point - look after your bank accounts.