Normally you brute force vanity addresses by having a range of acceptable outcomes, whereas to brute force a specific vanity address* you are only targetting a single outcome.
So they might have just set it to filter for facebook[dictionaryword]+ and this was the best match.
* Actually any address, it's not limited to brute forcing vanity addresses.
I guess I incorrectly assumed the process would be repeatable, but now I see that getting a specific duplicate equals bruteforcing the entire key space - even if the prefix is a chosen vanity name. I confused it with the effort of getting a similar address where just the vanity prefix needs to match.
So they might have just set it to filter for facebook[dictionaryword]+ and this was the best match.
* Actually any address, it's not limited to brute forcing vanity addresses.