Welcome to the Candy Crush Saga Community
Do you have a question or need help with your game? Ask the Community.
For me personally, I rarely have to log in to facebook, facebook remembers what computers I have used and keeps me logged in. It could be a case that whoever is using her account is using a computer that facebook recognises and assumes is your friend and therefore is not asking for a username or password.
The solution would be to change the username / password and then for your friend to log out of facebook using the log out button.
The next time someone tries to access her account facebook should require them to log in, which they won't be able to do with the username / password changed.
Elsa, Facebook remembers all the devices you use to access facebook / play games through facebook and keeps you logged in. so for example I can open candy crush app on my mobile and play without having to log in first, then when I get home from work I can go to facebook on my pc and play without have to log in first.
So If for example the op has logged in to facebook say from a work or public computer, facebook will remember that computer and the next person who uses that computer will have access to the ops facebook account as they will not be required to log in or enter a password.
The solution is to make sure that whenever you log in to facebook from a public device, is to make sure you log out after you've finished.
In your facebook account settings there is an option to view your activity log which will list alll the devices that have accessed your account and when. from there you can log out / delete any devices in the list, thus requiring those devices to log in with the username / password the next time they are used.