https://haveibeenpwned.com/

Chances are your email address (that you use for Facebook) has appeared in a breached credentials list - or many - hackers buy up these lists and brute force different popular accounts trying to gain access - most people use the same or similar few login/passwords pairs at every site they use! The site I linked above will let you know if your email address has been tarnished, and where!

(when I first looked up my old email address, I got heebie jeebies.. needless to say I started an entirely new main email account and use an alias for it now when registering at sites.. so [email protected] forwards all mail to my ACTUAL email address, but as far as sites and apps are concerned my email address is "[email protected]" -- obviously I've changed the name here)

It's always best to make a unique password everywhere.. I suggest lastpass.com, not only for storing passwords, but master keys, recovery phrases, 2FA backup codes (for when you don't have access to the 2FA device anymore).

Lastpass also offers more features for free that the other password managers charge you for! (my opinion)

I've been using Lastpass for about 10 years now - they've never had a breach. Everything, everything goes in there right away. It's been a lifesaver many times over. Best part is there is a web portal so if you ever have your device stolen, you could for example use a computer at the library or a friend's phone (in incognito mode!) to access the important credentials you need.

I dunno.. I don't work for any of these places, just services I use that I think have been super important in my online security.

TL;DR - Chances are your email address is on a spammer/hacker list and hopefully you make unique, strong passwords everywhere - if not, I highly recommend Lastpass (it will be the 'last password' you'll ever need to remember ;))