received email

Assuming she uses two-factor authentication, have her Check your Apple ID device list (https://support.apple.com/en-us/HT205064) and remove any device that shouldn't be signed in using the steps in the link.

If there are none that shouldn’t be signed in, then she should not have a problem at this point. But, if an unauthorized device signed in, have her Change your Apple ID password https://support.apple.com/en-us/HT201355 

And have her see these security-related Apple Documents:

 If you think your Apple ID has been compromised https://support.apple.com/en-us/HT201303

Security and your Apple ID https://support.apple.com/en-us/HT201303

iCloud security overview  https://support.apple.com/en-us/HT202303

Ways to keep your information safe on Mac https://support.apple.com/en-gb/guide/mac-help/mh11402/mac

____________

Also, she may have been the subject of a scam attempt. Have her:

Learn about Phishing, Scams, Apple Practices,etc.

 See If you see apple.com/bill, itunes.com/bill, or an unfamiliar charge on your statement https://support.apple.com/en-us/HT201382

See Identify legitimate emails from the App Store or iTunes Store https://support.apple.com/en-us/HT201679

See How to avoid scams when using Apple Pay to send and receive money https://support.apple.com/en-us/HT208226

For scam related information from Apple including reporting scams to Apple see Avoid phishing emails, fake 'virus' alerts, phony support calls, and other scams https://support.apple.com/en-us/HT204759

Identify scams related to purported apple notifications--Eric Root.

“Apple will always address you by your name or the name they have on file for you, not Dear Customer, Dear Client or by using your e-mail address. The e-mail will be from @apple.com or @iTunes.com. E-mail addresses can be spoofed. You can go to Mail/View/Message/Show all Headers to see more. Apple emails won't have poor grammar/misspellings. Apple e-mails will never contain an attachment. Apple will never request personal information by email such as Social Security numbers, your Mother’s maiden name or full credit card numbers. … 

“The only exception to the above I have noticed is if you order something from the Apple Store (apple.com), your receipt will be addressed to Dear Apple Customer. That is a receipt for a purchase you initiated.”

Has a credit card been charged? Are you sure the message is legitimate? Does it contain a link for her to sign in somewhere? It may be a scam. Check her purchases history.

Purchase History Review.  

First of all I would make sure that the email is really from apple by checking what email account the email was sent from. My wife has received fraudulent emails in the past and luckily she was suspicious and didn't click on the link in the email. If it appears to be a legit e-mail from Apple, I would change my Apple ID password and turn on 2-step verification for added security.