“3 attempts remaining” means there’s some plugin or code in place to prevent someone trying to guess or hack their way in. After that she won’t be able to try again until the set time expires. Might be a few minutes, could be longer.
She can try the ‘lost password’ link on the login page to try to reset her password. That will only work if the ‘developers’ gave her the right login information in the first place. Doesn’t seem like it if she has never been able to login (which you didn’t mention if that’s the case or not).
If that doesn’t work, look at this page for several ways of resetting the password. You only need one of them to work, so look them over.
If she can access WP on her hosting account server, she can look in wp-contents/plugins for a security plugin (for example, Wordfence). If there is one, it can be temporarily disabled by renaming the security plugin’s folder (for example: to ‘wordfence-hold’). That way she won’t get locked out before she gets this figured out.
