surely if the money was withdrawn through paypal, it will show up as "paypal" on her bank account? mine always does.
the biggest problem with accounts now is proving you did all the right things to protect the details, such as no., pin, passwords, etc.. if the bank can raise any doubt over these then they can try and pass the blame onto you.
this is creating a bit of a grey area over responsibility for security and it seems that the only way to force the issue is to take the banks (or at least threaten to) small claims court.
on a personal note, i have had no problems with security in paypal or elsewhere - but my wife had £2500 of stationery at a store the opposite end of the country (aberdeen - plymouth)
eek
put on her credit card. it had only be issued and used once at a branch of MFI to buy our kitchen, so it was kind of obvious where the git that got the details came from.....