My advice, in the short term, at least, would be to keep a comprehensive record of all of the times this person is taking advantage of the services; dates & times at least, whatever concrete evidence you can get access to (maybe even record what she's saying). And if your manager/immediate supervisor continues to be negligent, keep looking up the ladder to people you could get in contact with. It sounds like you understand the rules/policies pretty well, and could build a compelling case.