Okay, maybe I'll go with Crypsty. She said she had two factor auth on but that somehow someone had gotten in and emptied all her coins.
This seems highly unlikely unless she had thrown complete "caution to the wind" in regards to protecting her own password.