I recently had cause to log in to facebook (first time in 6 months) because my account had been compromised and was used to place a bunch of ads ("find hot guys in your area") which they had apparently approved (and ran to ~$100 in a few hours).

I was impressed with the account recovery process ("you entered an old password -- do you want to recover your account?"), but I felt like they were completely optimized for recovery versus preventing the intrusion in the first place (ala Google's two-factor auth).

Anyway, in this case they obviously took the wrong approach with the blogger and I hope it blows up in their faces. (Microsoft and everyone else used to not be nice to security researchers, Facebook will no doubt learn that cooperation is a better strategy too).