I do have experience in that area and having a *.facebook.com SSL cert is at the server level. He would have had to add that cert to the web server and set it in the config. Not something that happens by mistake. Unless it was some kind of DNS hack or something. Very strange.

Honestly after that I won't go there anymore. Something is up...