A Facebook hack cost her friends thousands. The company did nothing to stop it