First of all this is RETARDED.
So you leave your computer unlocked, no password on wake from sleep? So basically even though she got "crazy lucky" and got her computer back, all her data was exposed.
You have a choice between security & leaving you computer wide open with all your data to the world.
THIS WILL NEVER WORK FOR ANYONE WHO HAS THE FOLLOWING:
a login password (even if you share your login, better to share a password)
a password on the screensaver or sleep
a thief who knows what a System Disk is
Half their brain
OR You can be stupid and:
Leave your data accessible to the first person who touches your notebook.
Have your identity stolen (be tough to buy a replacement laptop)
There are other options. Like:
Have a password for login and wake from sleep. If your laptop is stolen while asleep, the thieves won't be able to do anything but reboot it. Make sure you have a firmware password so they can't boot off an external drive.
On reboot, have it login automatically to a dummy account. That way the thief won't have access to your personal information. My dummy account has a message on the desktop about my contact information and offering a reward. Make sure that, from this account, the thief
can connect to the internet and use applications. You
want them to connect to the internet as long as it's not from your own account.
Have
Undercover installed. After you've reported your mac stolen to Orbicule (the company that makes undercover) the next time the computer is connected to the net, it'll send you IP addresses, screenshots and pictures from the iSight without launching an application or otherwise alerting the thief.
I'm pretty sure that this method is close to foolproof on a MacBook Pro. It doesn't expose your personal information to the thieves and it does make sure that, at least for a while, they are unlikely to simply throw the machine away.
The small price to pay is that every time you reboot, you have to remember to press shift to disable automatic login or you'll go into the dummy account and have to log out from it.
I have no affiliation with Orbicule other than as a customer, by the way.