Well for one, she needs to change all of her passwords. It's good that you disabled the cell service though. Never have anything remember your passwords-- it mitigates issues like this. That said, no, there's not much that can be done.
The problem lies in the IP issue; as you're well aware the person is using wifi-- unless its a personal home address it's useless because the address links back to the router, not individual devices and their locations. More than likely they're on public wifi, which means due to DHCP you can't even find out what IP address they have on the subnet unless you have the MAC address of the device-- even then you won't know the location of said device. If they're using their own router, however, it will link back to that router which would then tell you the general proximity of the thief, but again, keep in mind that other people frequently use other's Internet connections. Without location services (GPS) finding the whereabouts of a missing mobile device is near impossible, since it's not connecting to the same network consistently and usually has a different IP on the subnet at least daily.
