If you get a notice from Facebook saying that your password changed, look into it! If Facebook doesn’t hear from you for a month, they’ll assume the change was legit. If it was a bad person, they’ll then have free reign to do any nefarious thing they want in your account, including spamming your friends or locking you out of your account forever!
This problem has now happened to two loved ones! Today we caught the baddies before the countdown finished.
When you’re done, enable two-factor authentication on your account (and all of your accounts!). It’s a tiny bother to set up but VERY worthwhile! Here’s how to set it up on Facebook https://www.facebook.com/help/148233965247823