Facebook's Bug Bounty Caught a Data-Stealing Spree