He didn't make a bug report. He didn't specify how he could post to other peoples' walls. All he said was that he could, and that he already broke the ToS by using it on another person's account. This was his original report:

    -----Original Message to Facebook-----
    From: kha****@hotmail.com
    To:
    Subject: post to facebook users wall .

    Name: Ḱhalil
    E-Mail: khal****@hotmail.com
    Type: privacy
    Scope: www
    Description: dear facebook team .

    my name is khalil shreateh.
    i finished school with B.A degree in Infromation Systems .

    i would like to report a bug in your main site
    (www.facebook.com) which i discovered it .

    repro:
    the bug allow facebook users to share links to other 
    facebook users , i tested it on sarah.goodin wall and i 
    got success post
    link - > https://www.facebook.com/10151857333098885
    -----End Original Message to Facebook-----

From that, you surmised that he exploited the "make a new wall post" form by replacing the user ID with another of his choosing?