"The problem lay in a private application programming interface (the slice of code allowing certain outside access) that wasn’t properly checking the person deleting the comment was the same one who posted it, the spokesperson added."

http://www.forbes.com/sites/thomasbrewster/2016/05/03/facebo...