There is a an argument for having separate domains so that official correspondence from a website is not easily spoofed. Consider someone creating an account 'payments@facebook.com' or something similar.