It seems the game has a low level of security.
If someone have access to the ID and others things, he can get your account from the support easly.
So I see some manners to prevent that :
- account creation on Internet (exemple : a Hive), then the ingame account will be linked to that account.
- that account should have some security like : mobile identification or mail confirmation.
- Delete the facebook useless link
Here we go