The only thing you can do is try to contact customer service with specific details and explain what happened and MAYBE they can help you. What email provider was it? If you can let me know, I can try to give you the customer service info if you need it.
As far as facebook goes, I made some screenshots to try to report it.
If nothing worked on fb, the only option she has (unfortunately their customer service is horrid) would be to report the account as a fake. Go to the help section and in the search box type fake account. Then select the option "how do I report a fake account that is pretending to be me" and send the link to that account and report it. Hopefully fb will at least delete it and your sister can start a new one. It beats letting the person continue to use it under her name which is really disturbing.
She should also notify everyone ASAP that was on her buddy list and tell them they should immediately delete and block her on fb. That will protect THEIR information (phone numbers, email addresses and any other personal information that they allow friends to see on fb. The longer this person has control of her account and access to all of her friends personal information, the more damage they can do. (sell their email addresses and phone numbers etc. Things could really get out of hand)
In the future, it is IMPERATIVE that your sister (and you should do this too) set up alternative means to stop this from happening in the future. My fb can not be hacked because I have it set up so that if anyone tries to log in from a computer or phone that is not recognized by my account, it locks it and will not let them in unless they can type in the code that is texted to my cell phone. To prevent problems with your email, you should also have alternative means to safeguard your account. (have a CURRENT alternative email address set up and/or cell phone that can be used in the event of a problem. Many of our members set up the alternative email account and then forget the log in info or don't log in for so long that the acct is closed and no longer active. Then when a problem arises, they don't have access to their back up alternative to get into their account that has been compromised. I'm sorry if none of these solutions work for the accounts she has now but hopefully what I have suggested will prevent this from ever happening again.
Customer service info for hotmail can be found here: