Which email service is she using?
Is she connecting with pop3 or imap?
You'll want to check the message rules and filters both in her outlook express and any webmail interfaces.
Sometimes hackers create message rules help hide from an account owner than their account is compromised.
It's also possible Grandma clicked something and made a bad rule, check for both.