My guess is that someone is using password db dumps and then using those credentials to login to Facebook accounts, in this case it reactivated it.
TL;DR Don't use the same password on multiple accounts, no matter how "unimportant".
TL;DR Don't use the same password on multiple accounts, no matter how "unimportant".
The number of sites that use - sometimes even requiring - SMS as a backup authentication mechanism, even while you use a separate authenticator app, is astounding. Cell phone number recycling is just as bad as email addresses.