I should have mentioned she lives 2.5 hrs away. I am sure I could have done it if it was local and I'd have driven there (I've run Fedora for ages on a laptop focused on containers as one of my machines so know my way around things) - but in this case it was as easy as going through the Microsoft Account password reset process. And I was able to mostly just point her at that/MS rather than need to do anything myself - which was nice.

Also my subsequent experience with the Bitlocker recovery key is that the machine is encrypted so I may have stuggled with mounting it from a Linux LiveCD and using the tools you describe. I doubt she turned this on herself so maybe the vendor (Lenovo) did?

I also think they are now turning Bitlocker on by default on all Windows 11 installs as well (it is why they want the TPMs as a requirement). Which is likely part of the reason they are now forcing this issue a bit so as not to have people all over with bricked machines and data loss if they can't recover the key. If you are AD joined it puts the recovery key on the computer account in AD - but for these home users they don't have that benefit and the cloud is a good place for it.