It might not be enough to convict her, it is enough to get a warrant. While they do rotate, ISPs do this with law enforcement a fair amount and I'm pretty sure they keep track of who owns which IP at any given moment.
> And that's assuming nothing proxying that connection at all.
A clever knowledgeable person would proxy, most people wouldn't know how. This is why I said it would be a foolish hacker. It's also possible someone else tapped into her wifi and did it. Or maybe there was no IP.
I'm just suggesting what is the most obvious piece of evidence which a judge would accept to grant a warrant here.
Find out the ISP that owns the address, ask the ISP what customer it was assigned to at the time in question, and while that doesn't tell you who was using it for the particular accesses you are investigating (it could be anyone in the house at the time, or someone outside using that house's WiFi, or someone from anywhere in the world using malware installed on a computer in the house), it does tell you that that house has a decent chance of having relevant evidence, and that will probably be enough to get a warrant to go look for that evidence.
That does not negate the fact that an ISP can trivially correlate a time-stamped IP addr with a specific user.
Having an IP address alone is not generally probable cause enough to get a warrant, because they are regularly rotated, and shared, across geographic areas. And that's assuming nothing proxying that connection at all.