Having an IP address alone is not generally probable cause enough to get a warrant, because they are regularly rotated, and shared, across geographic areas. And that's assuming nothing proxying that connection at all.
It might not be enough to convict her, it is enough to get a warrant. While they do rotate, ISPs do this with law enforcement a fair amount and I'm pretty sure they keep track of who owns which IP at any given moment.
> And that's assuming nothing proxying that connection at all.
A clever knowledgeable person would proxy, most people wouldn't know how. This is why I said it would be a foolish hacker. It's also possible someone else tapped into her wifi and did it. Or maybe there was no IP.
I'm just suggesting what is the most obvious piece of evidence which a judge would accept to grant a warrant here.
Find out the ISP that owns the address, ask the ISP what customer it was assigned to at the time in question, and while that doesn't tell you who was using it for the particular accesses you are investigating (it could be anyone in the house at the time, or someone outside using that house's WiFi, or someone from anywhere in the world using malware installed on a computer in the house), it does tell you that that house has a decent chance of having relevant evidence, and that will probably be enough to get a warrant to go look for that evidence.
That does not negate the fact that an ISP can trivially correlate a time-stamped IP addr with a specific user.
If you run an internet exposed service and you log IP addresses and have the ability to issue a warrant, it is entirely trivial to trace a request back to a specific house.
There are a lot of ways to obfuscate your IP address, but if you don't know how to cover your tracks, it's easy to get caught.