The standard thing to do would be to fill out a form, in order to have a deduction rate changed, and then another to have it changed back. It sounds like the form anyone else would have filled out would have gone to her, and then she'd have made the change in the payroll system. If she didn't fill out the forms, then what she did was irregular (and maybe worthy of some kind of discipline), but if she was smart enough that she did file the proper forms before she changed her own settings, then I can't see them making a disciplinary charge stick.
Even apart from that, so long as she paid the correct amount of taxes at the end of the year, she's not in any legal jeopardy. She didn't steal anything from anyone. I'm kind of cross with TFA for not explaining that clearly.
Obviously, yeah. Someone screwed up, badly, to have kept her on leave and on the payroll all this time, but that's not her responsibility.
Many years ago I worked for a restaurant whose owner was playing games with those employer-side deductions, trying (I believe) to stay solvent long enough to make it to the summer, and then pay off the back-due amount out of (expected) seasonal revenue. He almost made it, too. On June 15, however, I showed up to work to find the doors padlocked, with scary signs on them from some federal agency. The owner ended up having to sell his house and hold a yard-sale (seriously) to pay them off and avoid being prosecuted.
Everyone who worked there knew the state the business was in. For months I'd fully-expected not to receive my final paycheck, but the tips were good enough that I stuck around. Credit where due, the owner was honorable enough to send me, and the rest of the staff, personal checks to cover our final wages. I'd work for him again.
Meanwhile I can do just that and have been able to do that at every company ever. I don’t understand why this is an issue.