opened malicious attachment from scam email- what to do?
There is a rather high chance that the attachment was primarily targeting Windows system and didn't actually trigger anything on the Mac. Nevertheless the risk isn't zero.

What I would do in a similar situation if I wanted to reduce the risk and had a lot of time at my hand:


Tell her to shut the Mac down
Get an external drive big enough for the whole disk (an iMac with 10.5 is rather old, so make sure you get one with the right ports. USB2 isn't really advisable here)
Pay her a visit, boot the iMac from DVD and backup the whole disk to the external drive. If you can get the user-installed applications back easily you can also just backup the user folder(s)
Detach/eject the external drive
Reboot normally and log in to take note of


accounts configured in Mail etc.
usernames/passwords stored in Keychain

Reboot from DVD again and make a full reinstall of the OS from DVD
Upgrade to whatever macOS version you want to/can upgrade to (make at least sure to install all security updates)
Install an antivirus software (for what it's worth) and make sure the signature files are up to date
Attach the external drive again and run a virus scan on it
Create new user(s) and get the data back from the external drive
Enable Time Machine