Suspected account hacked

Hi,

My friend has her account recently hacked and all her emails were deleted.

She is unable to recover her emails using the email recovery function even though the incident happened just 4 days ago.

Are the emails permanantly deleted?

We are also interested to know if we can track any IP address or any other activity report to give us a hint where is the hacking coming from.

Any advise is greatly appreciated! Thanks.