Okay, so my friend got hacked, or something on facebook?!?! help?!?

alrighty, one of my friends on facebook messaged me saying "hey, is this you in this pic?" and gave me a link. i went to the link...and it showed the facebook homepage. right away i knew it was a hacker, because A: im always signed in and B: you sign in with a wrong pword and it still works. so if i put the right email/pword in, the hacker has it. but this hacker, made another profile of my friend...and they got hold of her pictures and friends and everything, now lots of people think its actually her. how do i get rid of the fake FB hacker? can i spam? where do i spam/flag/report? please help?