How can a friend protect her Facebook account?

A friend close to me posted some unusual things on Facebook, and I was suspicious. I asked her about them, and she was surprised. She did not actually make the posts. Her account was hijacked.

This is not the same thing as an impersonation. They have not copied her profile photo in an attempt to befriend her friends list. They are using her account.

So far it is harmless, but it is not guarantied to remain so.

This is not the first time this has happened. When it happened a month ago, she changed her password. Now, it has happened again.

How can she protect her account? What does she need to do besides changing her password?

GENERAL SECTION QUESTION