When Facebook is suspicious about an account, it asks the owner to prove his identity, even if he has the correct password.

WSJ: Spam Finds a New Target

That they have not hired the right leadership for security, implemented the right program, and then taken the correct tactical steps (for Gawker: exercising an incident response plan, implementing password complexity and use requirements, having an intrusion management strategy, having a data breach plan) in the context of an overall information security strategy.

FORBES: Discussing Gawker's Breach With Founder Nick Denton