Hasn't the window already closed? Short of doing everything you listed at considerable expense, how does this get made right? is that even enough? The heirlooms are gone at this point, you had a chance a few weeks ago but that stuff is long gone now.
There should have been a plan for this before it happened. part of that would be "hey, we'll do all these things, x, y, and z, in exchange please take your blog down" or at least "please blog that you've been made whole by the company, without mentioning specifics" or if you're a real pro, you present the victim with a contract before it even occurs to them to blog about it and you put that in it. It's too late now. Not just too late, but they've added to the "wrong" done to this woman. Plus if you "fix it" the pressure will be to reveal what was done, complete with rumors and misinformation bouncing around, rumors you can't control or fix.
I think it's business 101 in some line of work. Look at the LA Dodgers, a fan was nearly beaten to death at a game earlier this year and the team had reduced the security, fired the chief of security and done some otherwise stupid things prior to this (read: the dodgers may be responsible.) They can't stop the news, it made the news, but they swooped in, made some undisclosed financial arrangements and the news is about catching the criminals now. FWIW, this fan will never make a full recovery. The Dodgers have other problems and they aren't glossing over the beating but it's clearly not the focus it could be.
I've seen a remarkable number of tech companies do the same thing regarding security, to the point of even knowing they have problems and choosing to ignore them and hope for forgiveness rather than spend the time and money to fix them. If you're going to take that risk at least be prepared for when you lose. You have to come correct and offer up enough that it doesn't make sense for people to be angry, it has to be a legitimate apology with some contrition.