It takes two to tango
Yep. This is lousy security, but it is on the users as well as Facebook. Even if FB forced a PW change, that won't stop crackers from getting in. It might warn the user that something is going on or it might not. Either way, it reminds be about a saying about horses and barn doors. Users should also be held responsible for not keeping contract info up to date.