Honestly outside is sniffing their network traffic, installing a keylogger, or distracting them and hopping on their computer, you could either crack their password, guess their password reset question, or find a vulnerability in facebook that allows you to access accounts while bypassing legitimate authentication.
That being said, don't hope on finding the last of that list because I doubt facebook is that stupid.
