This is an important aspect. The affected individual might be using several other services that don't have the sophistication of Facebook's security team. Facebook might have been able to thwart the attack but his/her other online accounts might have been compromised.