Probably no much she can do. Someone has accessed member email addresses.
There has been some good advice here. I never use the same password for more than one account. For the most part I never use the same username for different accounts and never for anything involving finances or medical stuff.
I use passwords of at least 15 characters when allowed: with at least 2 upper, 2 lower case, 2 numerical and 2 special characters
Between work and personal stuff I need to track more than 100 accounts and passwords. I cannot remember that many. Fortunately there are many programs and apps that can be purchased that can be used to store and encrypt this info.