You know, I actually had this problem recently on a 2000 box. I set permissions to low on everything and still could get any active x component to run. It turned out that the file extensions were screwed up. Those are stored by profile I believe. Does hotmail and the bank both use activex? Or both jsp or asp or something common like that? That could be it.

You could also check the permissions on her cookie directory, if those sites use cookies to keep session data she might not have permissions to write to that directory? Thats a guess though.