They must have also had her email password as amazon would have notified her by email that the password had been changed, the scammer would have had to delete the message.
my dd had her amazon account hacked. The scammer bought some items and luckily she noticed very quickly. They also changed her password. She has been in contact with her bank and I have given her an amazon number to ring
I had removed my card at one time but have been complacent and they had my card number for purchases. I have deleted it again