I've been trying to think of a scenario to explain this. You are right. It is very unlikely be the thieves four years ago using it.
I suspect the card was stolen but had a nil balance at the time. She therefore has not used it, and not have the thieves. It finally expired so she was sent a new one. In her forgetful state she has used it, but not made any payments.
What is odd is that she should have been receiving statements, unless she had gone paperless on line.