I think you could go back and ask a few more questions, like how long she's been getting these emails vs how long she's been in the system total. If she's been in there for a while, and is only just now getting these emails, you may be able to track the starting point to some related incident, like ...