wife was issued an XP pro laptop.  She claims she brought it home,
opened IE, and it connected to the WEB.  Is this reasonable?

WEP64 should have at least kept the XP box from passing traffic.

Wireless encryption or some authentication of some sort would block traffic from entering - and passing through - your router to the internet and your LAN (couldn't even send a print job to a network-attached printer).

Hmmm... This shouldn't be. Check that the dopey Windows firewall
isn't turned on. (Kill it from Control Panel.)

Neil has a small built-in safeguard against a man-in-the-middle
(MTM) attack. As MAC addresses can easily be forged, creating a
generic whitelist of MAC addresses is weak security, at best. By
going Neil's route, *all* clients are forbidden to attach until he
disables the security. At that point, he lets the client connect,
adds that single MAC to the whitelist, and away he goes. Unless
someone is trying to access the network at that exact moment (with
*his* MAC), he should be reasonable assured that he's the only one
connected.