He had a Facebook ads account with PayPal linked, and the hacker used his login info to run their own (apparently Vietnamese aluminum product) ad campaign and spend using his account.
Why would anyone link those two things? That just seems insane to me.