Banks hold the patent on hoping problems just go away...
I'm not inclined to tell the elderly how to handle their thieving relations, but it would be wise to at least reduce the situation to writing, particularly if MIL has more than one child. That child may think you should have done something about the fraud.
Write MIL a letter and say "Here's what happened based on what you have told us. We are not going to report it to law enforcement because you asked us not to." (That statement has nothing to do with filing a SAR or complying with any mandatory requirement to report the abuse to the state.)
I would probably word the letter a bit stronger:
"Normally the Bank would report such an unauthorized access to law enforcement, however you have expressed a strong desire that we not take such action as you feel it would have an adverse affect on your family. Because you have requested that the bank not take any action to prevent these withdrawals, we must now consider all of the past and any future withdrawals from your account, for the purposes of repayment of the identified loan to be authorized by you."
I recommend that you have legal counsel review the correspondence before sending. If the bank does not want to pay for that, then you can go with your first recommendation to close the account. If management refuses to do either, then I suggest you write a memo to Bank management as well as report to Audit Committee this situation, the customer's response, and your recommendations.