Facebook account hacked twice in one day!

[nzoomed]

I had a client last week with a facebook account they could not get access into for no apparent reason.
Said invalid email, but was always the one they used.
Turns out the account was hacked and being used for SPAM.
I managed to reset the password only through clicking on the link in the email that said the accounts email address had been changed and went through the usual "secure my account" procedure and reset the password and remove the hackers email and add back the original email account, phone number, etc.

The account had a fairly secure password and this password was not used on any other online accounts they had.
Anyway a few hours later that same day I get another call from them saying the email was invalid again.
Turns out the same hackers email was back on the account again and their email removed.

Went back through the same procedure, i have no idea how the account got hacked a second time, but im wondering if it sent the hacker the same notification email saying that the address was changed that let them revert the changes?

Anyway, this time I enabled 2FA, I could not find any malware on their devices which was only a macbook and an android phone.

Really bizarre, ive seen the odd hacked facebook account, but never seen one get compromised twice before.

[TygerTung]

Maybe the hacker has access to their email?

[king1]

may well be the email account, i've see a few email accounts compromised whereby email forwarding has been added, so the hackers gets a copy of every email coming in...

[nzoomed]

Maybe the hacker has access to their email?

I dont think so, as there was no indication of any other devices logged into the google account, I changed the password on that anyway.
I suspect the person may have been attacked through a pishing scam, as the email account was full of SPAM

[Oh_hunnihunni]

Only happened to me once and Farcebook picked it up before I did and walked me through repair.

[Oldfellah]

Mine was hacked a couple of weeks ago, I received an email with numbers to reset the account and the email address to reactivate it was going to be sent to some scumbag at a Hotmail account, needles to say I didn't try to reactivate it but it pissed me off because I lost years and years of photos etc. Yes I had backed most of them up but there were a few that I hadn't. I emailed Facebook and told them what had happened but of course no reply, what was I thinking of to expect a reply from them!!