Is it possible that this password was really your gf's password in the past ? It could have leaked long ago and the hacker just decided to use a previously leaked pass to be more inconspicuous.
I don't think this whole story is so wild, it could be just coincidental. The hacker knew somehow about her DOB and thought this would be an easy password.
Rest assured a hacker wouldn't want to use their own password or reuse even one as that could link to previous nefarious activity. So they had to set up a brand new password just to move forward. So they set up anything personal they could get their hands on.
PS: you should check haveIbeenPwned for the address of your gf.
Big AI trying very hard to hide the truth about glue in pizza.