I recently found that facebook had linked to another email address that I NEVER USED with facebook. But used a computer with that primary email address but never used that email address to connect with facebook.
I changed the password, but if I had the save my password or leave me logged in I am not asked for the new password.
But there is a new feature, if you know about it or discover it by going through the settings that can notify you if a log in has happened at a new location that is not known. Don't know if that works for any system that you might have already been logged into.