It's not really 2FA if you can login with just the one factor of the phone… Maybe you unconsciously reset the password to your own at some point and it's saved?

Agreed. But its not even my account. I have similar things happening to me, except those messages are linked to my google voice number with someone else's account. One click and I am able to login. I had to block that number from receiving facebook updates.