Hacker News Reader

1) Yes, they either outright stole the credentials or stole an oauth-token.

2) The scammer either actually has a vietnamese metallurgy business ore (more likely) sold ad space on facebook to a vietnamese metallurgy business.

3) yes

Let me introduce you to the underworld of affiliate marketing https://www.investopedia.com/terms/a/affiliate-fraud.asp

There's always money to be made if you can generate significant legitimate traffic to a given destination.

3 - yeah my reaction too, I imagine it will no problem, just OP's case hasn't yet reached someone who can refund that figure.