Changing the user's password stopped the spam. I had previously checked her work PC for infection when all of this started and found nothing. I also assumed that since the IPs were foreign, it was outside of our network.
What probably happened is her home PC is infected and when she used the OWA, her login was compromised.
Thank you!
