> Sounds a lot like some service was logging the full body of a signup/login request, which then was readable for anyone with access to the logging/tracing infrastructure.

Wouldn't that also include failed login attempts complete with the failed passwords?

I mention this due to FB's history of even logging the entered passwords of failed attempts, which Zuck supposedly used to hack into people's Email accounts [0].

Because if that also applies here, then a whole lot of people just had way more leaked than just their FB password.

[0] https://www.businessinsider.com/henry-blodget-okay-but-youve...