It's far, far more likely that she was phished or that she used the same password on a site that was compromised than that her email password was guessed or sni

It's far, far more likely that she was phished or that she used the same password on a site that was compromised than that her email password was guessed or sniffed. (edit: of course, this is a general comment rather than any comment specific to OP's wife!)