Sounds like a scam. It looks like they don't really have her credit card data. They're hoping she'll try to "cancel" and, in so doing, reveal the card number. God only knows what the lowlife scumbags may do with it if they get hold of it.

She can, of course, report the e-mail to the authorities if she thinks it'll do any good. But I wouldn't try to contact the sender under any circumstances. To do so would just open a door for more of the same.