The attackers exploited a feature that lets users see their Facebook page the way someone else would. They could then potentially use it to take over the accounts.