[Xenon]

Yep, it holds a big security risk:

as long as she doesn't log out, any user with the same external IP will ahve access. for example if she works behind a router, everyone behind the same router will have access.
also if she forgets to log out, and her ip will change, the old ip (if it's dynamical could be assigned to someone else who will get access)

and yes, you should encrypt the password. if there is any security flaw and someone gets access to the db he can read the pw and then knows it forever, and if she doesn't have different password, that won't be good