Sounds like something is sending. YOu may want to have the user reboot in safe mode with networking and install and run Malwarebytes on the system.
http://malewarebytes.orgEv
en if they cannot get ot safe mode, you may be able to still install and run malewarebytes in normal mode.