Richard, go to the EVENT LOG and you can see who connects and when. As far as "turning the internet off", the best they can do is disable the network card, but they would have no way to reconnect the next day to enable it, so that one there you would have to provide more details for. I did a great amount of black hat hacking in my day and know a lot of tricks.

If they turned her internet off and by that you mean her interface from her internet provider dropped link, then someone at the spammer end had to social engineer his way into the provider and posing as her have them shut the service off.

This often goes much deeper than just them calling. The social engineering part often plays a bog role.

As far as Team View installed in 2007, the spammer didn't do that.

Remember these people shotgun dial. Nobody came after her specifically. She was the next number on the robodialer.