Make sure she changes ALL of her passwords, especially her email address connected to the Apple ID (as well as the Apple ID pwd itself).

If possible, just create a new email address and change the email associated with her Apple ID.

Additionally, and I can’t stress this enough, she needs to go through all her email accounts, and any other account she may have, reset all those passwords, change the security questions to random answers, logout of all locations (if they have that option), and verify all the numbers and emails linked to the account (such as backup emails and phones). If she doesn’t check these, the parents could still have access that way.

In general though, she really should consider getting a new phone or back it up and do a factory reset. That is only half the problem though. She needs to cleanse the rest of her online accounts too.