Either your friend sent the ETH there by mistake or she was a victim of phishing sites or stuff like that. You can see that the ETH left the wallet only 2 hours after they have been sent to it so either the hacker got access to the wallet then or he had access before and was watching the transactions closely and waited until a significant amount of money was on it. Looking at the wallet the ETH were sent to it looks like an average users wallet. It has a lot of ETH on it and some meme-coins. So he is not trying to send the ETH around to other wallets now to make them untraceable.
i noticed that it just sits there, should I tell her to get the police involved? seems like they are thinking it is nothing going to happen to them with the stolen loot, and 15 eth is not a small amount.