> Shreateh reports he will not, however, receive a bounty for his work — per an e-mail from Facebook, he violated the terms of the program when he hacked Zuckerberg’s account.

I think this is wrong. He posted on Sarah Godin's wall first before making any report, very clearly breaking the rules FB sets up for its whitehat program. They offer a way to create test accounts for exactly this. Posting on Mark Zuckerberg's wall has nothing to do with it.

As far as I'm concerned. FB's only mistake here was to brush him off instead of asking for further information from the initial report. Hardly newsworthy.