I guess what it comes down to is this:
If she is manually sifting through the highscore and scrying data and entering this all into a spreadsheet by hand, she isn't doing anything wrong. The sheer amount of data she'd need to process to get to where she is and conveniently time all of the attacks right out of protection (even those coming out of protection at irregular times) makes this
*HIGHLY* unlikely.
If she's using a script to pull data and import it into a spreadsheet so she knows when and who to attack, she is clearly in violation of the ToS:
5.3. Using third-party programs
It is forbidden to use any programs or mechanisms that change and/or influence the operation of the program, makes the game automatic, lead to excessive server load or use "bots". If our algorithms detect such activity it may lead to immediate and permanent suspension of account.
Common sense dictates the course of action here. It's pretty much humanly impossible for her to be processing all of this data by hand. At minimum, she's using a script to pull the data into her spreadsheets. More than likely she has a script that processes that automatically pulled data and is attacking for her.