This is why I do not put a PIN code on my devices. I want to encourage the thief to keep using it. That way, I can successfully track it with the FindMyiPod service.
www.icloud.com
Log-in with her Apple ID. Locate.
[edit]
If its unlocked, and the thief is using it, DO NOT tip-off the thief with a message or remotely-added PIN. DO NOT remote-wipe if you want any chance to get it back (unless there is sensitive stuff on there and you and keeping it away from other people is worth more to you than the cost of the iPod). Change all passwords for email and Facebook. For services that give you the option, reset session IDs for cookies that keep your device logged-in (Facebook and Google let you do this). DO NOT change the Apple ID password. I'm not sure, but I think it would block you from tracking your device.