Normally I would agree 100% with that, but they did KYC on the customer for the first withdrawal. That must include a SE check, especially if it was on withdrawal, which it was. The customer also spoke with live chat who confirmed it was acceptable to use her bf's account for deposits/withdrawals. To me, those two things together mean they were happy for her to continue using the site unrestricted, and they should pay her.
Also, she isn't self excluded (obviously assuming the story is correct as posted), therefore the self exclusion reason shouldn't come into it really. If it was on the first withdrawal and there was no live chat conversation or KYC done at that point, then I might think different, but again, she had been through KYC, if there were doubts about who was actually using the account then they should have been addressed then, not at a later point when she won a lot of money.
If it happened to me in the UK I would be issuing a claim against them in court and would be confident of winning.
I never understand why people say 'you should never believe what live chat say' either. Thats bullshit. Live chat are customer service. If you ask them a question, it should be answered correctly, you shouldn't be lied to. If you have it in writing that you can do something then the casino (or any company) should uphold that agreement, and if it were used it court, it would almost certainly be taken as evidence. Its not the customer's fault casinos don't bother training staff, I can train a monkey to copy and paste 'can you clear your cache and cookies', surely casinos can train humans to do a little better.
I've said for a long time, casinos should be forced to have a tick box on the sign up form saying 'if you have self excluded from any of these casinos, you cannot sign up here, if you do you will not be paid any winnings' then either a list of the casinos on the license or a link to the license, and not a hidden one like a lot of casinos use buried away at the bottom of the homepage. It wouldn't have a made a difference in this case but would stop a lot of the self exclusion problems we see regularly.