This looks like an ongoing fraud by a single bad actor. I'd strongly recommend that you start bouncing any future checks of this nature, marking them "signature irregular" or something similar. Don't use "forgery," since you haven't received a forgery affidavit from your customer.
It's possible that your customer has knowingly permitted these checks to be issued and paid. That gets you off the hook. It's also possible your customer has more money than common sense, and has simply not reviewed her statements, or otherwise seen evidence of the forgeries.
I recommend you review the "same wrongdoer" provision of section 4-406 of your state's version of the Uniform Commercial Code. That is where your defense strategy should start.
John S. Burnett
Fighting for Compliance since 1976
Bankers' Threads User #8