They have her ip address [1]. It is super easy to prosecute with her ip address marked on the sent message. I feel bad for her, but, why hand the prosecution so much (use a vpn)? This is like driving drunk with your headlights off. At this point, she will have to plead out.

"An affidavit for the warrant claims that an unauthorized message sent from a state emergency management account on Nov. 10 was traced to an IP address associated with Jones."

https://www.usatoday.com/story/news/nation/2020/12/09/raid-f...