If he have mobile-phoned connected then consider it as done, If not we will need to bruteforce into his connected email (bypass its 2FA through OTP Bot or sim-cloning) then verify 2FA for facebook, and its process but do works contact me on discord if you still looking for it
s1mpl3e
s1mpl3e