Maybe the oauth scope requested edit access to the FB business manager? That way the scammer can remove OP from the business and add himself via the API