I worked for an IP provider for many years. It is possible that the IP has been reassigned, but the detailed logs should reveal the MAC address the IP was assigned to. The question is how fast the logs are overwritten, but the speed with which she escalated the situation likely means that those logs have already been pulled in anticipation of a possible investigation by the AG.
Second scenario is posible, but not likely. In that case, yes, a vindictive neighbor could do it, but then it again comes back to if the customer has the equipment used (MAC) that cancelled the reservation.
The more likely scenario is that someone used a public access point, then they will never figure it out.