I do know the person who sent her the .pps and she indeed did send it.
If you find the mail in the inbox/sendt item then as suggested you may upload the attachment to VirusTotal and test it
did she forward the mail or did the machine to this all by itselfe ?
She comes up clean on a Malwarebytes scan....
was Malwarebytes updated before the scan ?