A blogger named Laxman Muthiyah discovered the issue. This was all able to happen by exploiting Facebook's Graph API, which is the HTTP-based software that allows the website to function. Graph API requires a token to mess with someone's data, but Muthiyah tricked Facebook, using his own token, into deleting other people's pictures.
