No, she did not use a token, since we didn't knew that there was one for Iphone/android.
However, her accountname was picked for this game, and she doesn't have a small or easy password. She didn't have 1 specific mailaccount for a game but she does have 1 mailadres for games, thus only used before by ultima. She didn't buy anything from goldsellers (why would someone even do that?) And the only mail she got from square was one that said that she just payed for 1 month. No link in there, and she didn't click on any other kind of link like that.
Also for the above poster, so does this account to everything? I should assume that if I play sorta safe ( and not totally covered in ANY kind of security) that I can just play normally. If I don't give my information to anyone I should assume that I should not be breached.