One bit of evidence would be to look at the blockchain to see which address she sent the funds too. If she sent the funds to an address full of ETH then I might be inclined to believe her that it was just a dumb mistake. Since she said it is a ponzi scheme, there must have been ETH already in that address prior to it being sent, since in ponzi schemes they pay out to old investors with new investors money. Can she provide the address and transaction?