Yes, it's legal, although the responsability for payment lies with her. You just get to collect the history and use the card if you choose to do so. Yes, she can have you removed as an AU but you will also loose the history associated with the account.