File a police report in your local jurisdiction. If you’re in the US, file a report with the FBI regarding a violation of the CFAA (computer fraud and abuse act). Take the results of that to Meta. You want to demonstrate you’ve established a paper trail documenting the unauthorized access of your friend’s account.