Here's what you need to do:

Get the add-on. On her device, go into Options and disable TCP access. That way, her device will only use the blackberry.net APN, and the access will thus be free. If you are charged additional, call T-Mobile, explain that TCP is disabled on the device, and they will remove the charges.

Basically any application written by RIM will go over the blackberry.net APN, so there is no need for the either epc.tmobile.com or wap.t-zones.com to be enabled. I use e-mail, BBM, browsing and Facebook with no additional charges.