It doesn't sound like it's worth persuing ("the email address is old and she's not sure what's in it"). You can try emailing the account in case the hacker is

It doesn't sound like it's worth persuing ("the email address is old and she's not sure what's in it"). You can try emailing the account in case the hacker is still looking at it, but my wild guess is that it was low-hanging fruit and the attacker abandoned it when they discovered nothing worthwhile for them. (The email could say, when you discover there is nothing worthwhile in the account, can you please give it back to my grandmother be setting the password to 'PleaseLetHerHaveItBack'.)