There are two major possibilities.
It's possible that someone posing as AOL staff tricked her into simply telling him (or her, as the case may be) her password. This process is commonly called 'phishing' by most of the people who do it ("social engineering" is used by most others) and is still surprisingly effective even though AOL plasters "AOL Staff will never ask you for your password" all over e-mail and IM windows.
The other possibility is that someone simply guessed it. This isn't always as hard as it sounds. You'd be surprised how many people use their own names (or worse, their own screennames) as passwords. Worst of all, though, are the ones who simply use 'password' as their password. You'd be surprised how many people actually do this.
It's possible that someone posing as AOL staff tricked her into simply telling him (or her, as the case may be) her password. This process is commonly called 'phishing' by most of the people who do it ("social engineering" is used by most others) and is still surprisingly effective even though AOL plasters "AOL Staff will never ask you for your password" all over e-mail and IM windows.
The other possibility is that someone simply guessed it. This isn't always as hard as it sounds. You'd be surprised how many people use their own names (or worse, their own screennames) as passwords. Worst of all, though, are the ones who simply use 'password' as their password. You'd be surprised how many people actually do this.