Track when an iPod Touch was restored
To answer the last question first, no. You can always force a device to be off and then force an erase/restore. You should be able to tell since everything is gone. Worst case someone has an old backup of her content and restored that. 

It is far more likely the culprit has guessed the passcode and is messing with you all. Second most likely is a jailbreak and known admin password. 

If the suspect is technically sophisticated, it's possible they can pull this off but the security of passcodes on iOS is quite secure in general.