Other than that check her usergroups she belongs to and her as a user, if her stand-alone options for her user only are set to require it.
If all of that doesn't help (surely it must be in user(group) permissions), then go to your config file and put this into the file, which disables completely two-step verification for all users and you can't un-do it in ACP.
You can come anytime to XF when you need more help. But as I said, it must have been a permission setting which enabled two-factor authentification. Or there is an addon involved which did it (but I doubt it as I haven't seen an addon which operates with 2FA.)
If you have put it in the config file that 1 line, you can easily test it. Go to a usergroup where you are in, put the permission to "yes" and log out from the site. Try to log in and see if it asks for it.
edit:
Btw. you can see for each user if it is enabled in their user profiles in ACP, in my example for the user "admin".