My knowledge here isn’t perfect, but I learned a lot from this discussion on the Privacy Guides forum.
You might find this chart to be helpful as well.
I’d personally go the route of getting a new phone number and a new email address.
If she needs for people to be able to reach her at her current number, I’d restrict it to people in her contacts
Even if you manage to pull the information from people search websites, her info is still out there. I’d also avoid giving out the new phone and email as much as possible.
You are assuming intent, and ignoring the false statements made. What I see is them hiring a third party to do an investigation, exactly what the public called for. Would you rather the former employee pay for it?
There was no threat, only a statement of fact that the evidence was strong enough for a defamation case, and that they did not wish do go down that path.