I dont want to blame or defend victim or perpetrator in this case but:
Before you start blaming, at least make sure that emails she got, are legit. Tell her so post full email headers /email source so you can check if email was indeed sent from gmail’s server.
If full email contains SPF & DKIM signature, that would confirm authenticity of emails’s content and email’s sender. DKIM can be verified even by third party is she shares email with with them.
There are plenty of easy to find websites that allow you to send emails that appear to come from any address you want. Here are just two examples: