Libelous doesn't matter; the CFAA only cares if you accessed a protected computer and obtained information or caused damage. And getting the password from the account owner may not matter either since the protected machine belongs to Facebook - Facebook v. Power Ventures held that user account access isn't enough.

I agree that a suit or damages would be unlikely, but that's only at the discretion of judges; the basic CFAA violation here is unambiguous.