I did indeed read the article which I shared with you. In fact, right after that quote which you mention, there was a statement from a facebook rep who concluded that this was not a clickjacking case and that they were most likely accidental clicks on a cramped mobile interface -- regardless, clickjacking wouldn't explain your friend's story who wasn't even logged in, would it? They would have had to, as you say, "hacked into his account" do to that. But I haven't seen any evidence of this in a reputable news journal. I'd love to see a source if you can find one.