I wouldn't assume illegal activities occurred. Did you know facebook had an easy to access search feature for key employees to view anyone's private profile. All very legal.

As for the ethnical issues. I'm not sure I buy in. At one point typing profilename/photos showed you everyones albums private or not with a small picture. You needed access to go further. That's more of a facebook design decision. At least one private photo and the any album name were purposely not private.