Most people use easy to remember numbers so if he used like his bday she could have gotten the info from his wallet or maybe he wrote it down on a piece of paper and kept it in there. Its also possible Ugandan ATMs have shit security and she just brute forced it.