First - if she notified you on 9/14 and you're still figuring out how much to give her, you may already have a violation under Reg E by not providing provisional credit within 10 days.
The rest of the story depends on how you handle ACH disputes and POS disputes. You can hold the customer liable for everything that occurs after that 60th day IF you could have prevented the POS transactions from occurring. Do you close the account and open a new one? If so, you could probably argue that you could have prevented the POS transactions from occurring. Do you simply place a stop payment order on the ACH and return those transactions? If so, then regardless of notification date, the POS would have still occurred. Take a look at 1005.6(b)(3). When in doubt, best to err on the side of the customer. Remember Reg E is super consumer friendly.
For what it's worth, we work ACH and debit card dispute separately. The timing never overlaps. There may be a few occurrences where we've returned more than is strictly necessary, but it keeps the waters from becoming too murky.
_________________________
I reject your reality and replace it with my own.