There is an appeals form https://support.google.com/google-ads/troubleshooter/7217496...

from what you describe (they are not tech savvy, and when you looked everything was fine), it sounds like the site was compromised at some point. It could be compromised now, but maybe only shows the hacked content (with counterfeit goods) to certain visitors (e.g. normal content when you type the address directly and hacked version when the referrer is Google search or ad). This is a common technique so that the site owner doesn't see the hack.