sign out turn computer off
Restart Router
He's most likely just used IPGet and thinks he's got her IP, and thinks he can wreak havok because it is 'possible' to 'hack' someone using their IP address but in reality people have got firewalls now and updated software and OS's themselves generally will block most malicious attack attempts now
That's really all it could be he managed to get her IP address through a direct connection to her computer (and using some sniffing tools/scripts) by file transfer or webcam or something else, so if she has an internet connection that assigns her a random IP each time her router/modem is started (most ISP's have this, few have static IP's) then just restarting the router should get her a new IP