This happens with lots of email providers- emails are sent that appear to come from someone you know. It may just be an individual account that has been compromised. Sometimes they access the contacts list. You may find that the email address used is not exactly your sister's- it may have adifferent ending. There are lots of sites giving guidance but the conclusion often is that there is not much you/they can do after the event apart from changing your password or email address