Friend's profile being jeapordised?

[Shirley]

My friend's profile on Facebook has been accessed.
They have changed her cover photo to two naked women in the water, and put up statuses like 'I love the boaby' and keep putting up that picture when people say things like 'WTF'.
She's in tears, and I don't know what to do.
I showed her how to deactivate her account and change her password, but I don't know how this might've happened.
To my knowledge she hasn't given out her password and hasn't given out any clues as to what it may be.
I believe it is someone she knows, or someone local, because they used local slang terms like 'boaby' (pen15).

Any ideas as to how this happened, or what I could ask her to find out how it might have?