Are the messages in her outbox? What some scammers do is they make a new account with the same name and profile picture, to then send messages that look like they're from a friend.
I remember reading about an Facebook phishing thing going around, but that involved getting the password and then spamming out messages. She could try and remember if she got any weird links that she logged in with. Sometimes the scammer sends the harmful link to the followers, so the handbag site might be the problem link