Prosecutors were initially unable to charge Drew with anything because they couldn't find an appropriate statute under which to file charges. A grand jury in California, which is where MySpace is headquartered, eventually decided to pursue charges on the grounds that she had provided the site with false information. She is now being charged with "accessing protecting computers without authorization to obtain information to inflict emotional distress." (The Smoking Gun has the full indictment.)
Drew has maintained that she did nothing wrong, even going so far as to shift blame onto another girl, 19-year-old Ashley Grills. The indictment mentions unnamed "co-conspirators," but none are Grills: she's actually a key witness for the prosecution.
No hypothetical jail terms have been bandied about, but yeah. Nothing is too long so far as we're concerned.