I reported it stolen to the police. They took pretty detailed information and said the detectives will probably want the security video and screenshots of all conversations, which I will happily provide to them.
I doubt I ever see the package or the money again. I also kind of doubt she will actually see any legal consequences because she can deny it. When she is shown on camera holding it, she can claim it's a different package since the video is not high enough resolution to show the label. Regarding the person selling the items on Facebook, she can deny knowing her or giving her those items. I sort of doubt the police will devote much time to pursuing it, but at least if they make her life miserable for a period of time and she gets fired from her property management job, that's some form of retribution.
I will have my wife talk to the online retailer to see if they will do anything, and it was purchase on a Chase Sapphire Reserve card which also has theft protection, so maybe one of those will be helpful for getting some money back.