I assume they aren't emailing Mark Zuckerberg with every account they steal. All it takes is lax internal auditing and a culture where customer service[1] is not valued and this could go on for a very long time.

[1] Ok, this is a little unfair. They do have customer service, but what they don't have is product service, and this guy is just part of the product, not a customer.