Most, "I've been hacked" on FB really isn't I've been hacked, its more...
"I've been impersonated", to keep this from happening the impersonator needs access to your friends list. Just change privacy settings to hide your friends list and it will stop happening.