Email hacked solutions

Does your friend have a good backup?

My guess is that when they clicked the link they installed a program that sends screenshots to the hacker.

What kind of phone/device is it?

The first thing she should do is put the phone in offline mode, disconnect any wifi, etc, and check permissions. People tend to grant access to everything. It sucks, but she needs to go through her phone with a fine tooth comb.

If it's auto-backed up to the cloud she needs to make sure there aren't suspicious apps/contacts there too.

^^^^^^
Good advice.
This sounds like a wipe and restore to factory mode.
It it's a laptop, make sure you have a good DNS tool that will check all links you click on. Open DNS has long been the defacto standard in that area. The Cisco version isn't available to consumers (Cisco owns it now), but there is a consumer version for consumers.

They usually put a filter on your inbox so any new recovery emails that come in go back to the threat actor and they get all the resets codes etc. friend needs to sign out of everything electronic and change passwords everywhere to something new. Also get try and use password managers with auto generated passwords. Get password app on every device you use so that friend does not go back to bad password management.

If you dont change your password every so often they get leaked into DB's on the dark web. If it was stale password its easy to get into an account.

Also there is no defense, they fricked up. Learn the lesson or repeat it.

Can also check contacts in icloud and sort by date added. She may have a new one that she doesn't recognize.

Basically, she needs to go over everything and delete anything that looks suspicious. Any "shared" logins, etc.