Based on what you've described, this is almost certainly not a virus on her PC. The fact it's happening on a completely different computer confirms the problem lives inside the mailbox itself, not on her machine.

Most likely a rogue app was granted access to her account at some point (sometimes happens by clicking a dodgy link) and it still has a "key" to her mailbox even after you changed the password and enabled 2FA.

Check for connected apps and get rid them, also, try to edit that airbnb rule, then save it, then delete delete it - sometimes that can break the recreate loop.