used the same password in multiple places and/or you got your email hacked and you were using that for 2FA. I get notifications even if I try to access Facebook from a new device myself. If you really want to be safe, use an authentication app.