You mean until law catch him.. because that's between Identity Theft and Facebook going to send you a lawsuit because you're hurting their company. Even if users agreed that their account could be used to do anything via token. just have a look at google..many times happened.
The worst thing is he uses it to post adult images!! That's not just identity theft but damage of persona... If they get him, hes better living in pure nature without internet and docs. (Not so bad afterall if you ask me..living in the nature freely!)