Joe Offer wrote: But what can I do about it? I don't want to email her because I'm sure her email is compromised.

Her email may not have been compromised. It's very very common to get spam which spoofs the sender address.

If you hit 'reply' - without sending it - does the reply go to a different address? (i.e. does the email have a different 'reply-to' address.) If so it's almost certainly a spoofed sender address. And even if the reply does go to the same address it does not prove her email account is compromised.

What can you do about it? Nothing much. Some ISPs' email programs have a spam button to let them know. Let her know if you can, as you're trying to do, but it doesn't mean she can or has to do anything if she can access her email account OK and there's nothing odd in it.

(If she sends mail to multiple CCs, she should use BCC instead. That's one way her friends' email addresses get onto spam lists.)