If they had forwarded that mail to someone else--"Hey look! Someone mentioned me on facebook!"--then that second person could have logged into the first person's account with a single tap.

It's scummy and terribly insecure to pass around someone else's credentials via email.