-snip-
I am beginning to think that they acquired the address from some other source and not their Trezor One. They are quite certain this is not the case. They assure me they had no other wallets or accounts other then Coinbase and they are not there.
Are you certain that you've sent Bitcoin (BTC) to your sister and not Bitcoin Cash (BCH)?
Because in 2017, BCH's address is the same as Bitcoin's legacy address; thinking you/she might have remembered it incorrectly and it's Bitcoin Cash all along.