I wonder if it there are facebook internal 'admin' type employees that are stealing accounts in this way.

That would be a way to get the code. Wouldn't be too surprised if facebook was skimping on oversight.

Do you know what the behavior of the account was after takeover? Was there a clear monetization strategy (ex posting links, sending spam messages, etc)?