Primarily, you’ll want to look over the devices logged into your Facebook account. If someone has stolen or compromised your password, it’s possible that they are lurking in the background.

Mercifully, Meta, owner of both Facebook and Instagram, has a single site for all your account information (accountscenter.facebook.com and accountscenter.instagram.com bring you to the same page).

Facebook provides a security feature that displays a list of devices used to access your account, along with details like device type, browser, last access time, and more.

That is where my credentials would have been compromised, and quite possibly, some kind of 2FA bypass attack could have been involved, but I never got that far to find out.