I have no clue about FB as I don't use it. I doubt that they can access info in private profiles, especially private messages, unless the either system has glitches or someone hacks into it or something. The hacking is something I would not think many Ts do, especially just to have some client info. That I would consider unethical and intrusive. What I can imagine in some cases is creating fake profiles, just like many people, but even that way I doubt they can get info actual private conversations. I doubt many Ts would have serious web spy skills/resources anyway and probably most are wiser than risking their reputation and license with illegal spying maneuvers.

It is pretty easy to trace perfectly legal, publicly available info, scan people's connections, put pieces together especially if someone has a knack for research and connecting the dots. I sometimes read here in PC therapy clients assuming that Ts are not interested or are way too busy and would not have time for this. Well, I am a very busy person and still do this whenever I have the interest. It does not require much spare time and can do it wherever with a device and internet access - between meetings, while traveling, just as a personal break from a project I am working on, as entertainment - it really is easy. I don't think there is anything unprofessional or unethical about it as long as the info is public and they keep their findings to themselves. Questioning a client with it or otherwise using it in indiscreet ways would be a whole different issue, that I think is very wrong.

If a client suspects that a T accessed truly private, secured info on the web based on what the T says, I would imagine perhaps it's much more likely to be coincidence. Or the client gives away hints in direct interactions without wanting or even noticing, and the T just puts it together as intuitive guesses.