They would need to be on the same network as him, or infect him with spyware.
Yup, and since he's asking about FB it would probably be someone he knows. They could go to his house sit outside on a lappy and get on his wifi. And I'm sure you could find spyware online to do the job if they wanted to do it remotely.