1) Yes, they either outright stole the credentials or stole an oauth-token.

2) The scammer either actually has a vietnamese metallurgy business ore (more likely) sold ad space on facebook to a vietnamese metallurgy business.

3) yes