I stopped reading at this point ...

Facebook claim it can only be done by the hacker getting access to my account password, (very unlikely)