Fairly sure someone is. I haven't been using FB for months and last week received a "messenger sign in code" SMS from FB. (I use LastPass btw with each site their own pw, I highly doubt they need your actual current password to login)
The number of sites that use - sometimes even requiring - SMS as a backup authentication mechanism, even while you use a separate authenticator app, is astounding. Cell phone number recycling is just as bad as email addresses.