IANAL, however, I think she would have had to notify them immediately on discovery of the loss. Normally, that is within a day or two of losing the card. In this instance the card was not lost; the number was misused. Presumably she had to notify the issuer within days of receipt of the bill. But then it becomes a matter of contested charges.
At this point a good lawyer could have helped her. Apparently, she waited until the case went to collection, without invoking her rights. Credit card companies don't send a case to collection immediately. So there's a question as to why they sent disputed charges to collection and how long it took them to do so.
A lawyer could have invoked additional defences. For example, credit card companies will start to query charges as soon as an unusual pattern develops. I've had charges refused because I was in a different country or a different state, or was charging types of items I don't usually charge. Usually, this means I have to call the credit company and talk to them, identifying myself by several bits of information. None of these are impossible for a good thief to find out (mother's maiden name, social security number, billing address and zip code), but they should stop casual theft.
In this case there's an implication that the thief claimed to be the woman's sister. But the credit card company should have called the woman's house, or even sent a letter (I have received such letters -- not much help for me because I was out of the country at the time, but possibly helpful in the case of this woman).
The latest I've heard is that some on-line sites, such as Verizon.com, are limiting their liability if their website is hacked.
[TELECOM Digest Editor's Note: Yeah, but Verizon is not a credit card company. I was speaking about the banks which distribute Visa/MC and put customer balances on line for review, etc. PAT]