I was on the real live internet at about fourteen and generally online on the major BBSs (Prodigy, AOL, etc) at about ten or eleven, though I admit I was a pretty old eleven. My parents told me never to give out my real name or address or anything like that. The scary people they’d always told me about when I was little, the ones with candy or puppies to lure kids over, were out there too. They would pretend to be my friend but that didn’t mean I was safe. This was before big kid/internet scares, or at least before they were really publicized, as far as I know.
I mostly obeyed. I told a few people my name, since that seemed harmless. I told one or two the nearest major city to the small town I lived in. I did tell people sometimes that I wasn’t allowed to tell them the name of my school. I also told people I was a 21 year old lesbian, so do with that what you will.
I’d never dated or kissed or seen anyone but my mother naked in person, but I had a fairly active cybersex life. I never gave out my address, but I know in retrospect some of those people were pretty skeevy – either they pretended to be grownups (rather more common at that point, I think, than adults pretending to be kids) or they were uncommonly interested in fifteen year old girls.
“Don’t tell them your name,” my mother had said. “And if you tell them your name, don’t tell them where you live. And if you tell them where you live, don’t tell them where you go to school. And if you even tell them that, for the love of God don’t tell them your address. And if you’re that crazy, at least don’t agree to meet them. You wouldn’t tell a random stranger on the street where you live, and you are going to know less about who you meet online.” She also brought up the 40 and in his mother’s basement image, and believe me, it stuck. 
Regardless, I have met several people from online. I did for the first time as a freshman in college – a woman I’d known online and chatted with over the phone several times who met me in public with lots of people around. I miss her and wish we had kept in touch. I visit online friends in Canada yearly and closer by more often. I’ve had crushes on and even fancied myself in love with a few people I’ve met there, and I know at least part of the reason is that there’s no pressure and no expectation. If they disappoint me, it’s a lot easier to cut off ties. If I’m in a bad mood I don’t connect, and same for them. We never have to deal with one another’s bad moods or worse decisions or borrowing money or holding each other’s hair while the other pukes out a bad night pub hopping. It’s all very slightly unreal.
I would definitely advise a gentle talk, but not necessarily “So we’ve been snooping and we’re disappointed.” If you have to pull that card, do it, but I’d start with a careful discussion of the situation.
If, of course, she’s savvy enough to realize what you’ve done from what you’re dancing around, that could make things worse.
I just realized I still remember my old Prodigy logins. Creepy.