I say "hacked" though it's possible that relative (or a family member trying to help when they realised they couldn't log on to Facebook) clicked on a malicious link in an email to "recover your Facebook account".
We have been through the usual instructions online but can't receive a recovery code as the associated password, email and ph number has been changed by the hacker. The process ends with a page on Facebook saying they can't safely proceed further. Messenger and phone app has been logged out, and we can't log in via the username either. We don't have Twitter or IG accounts to message meta directly, can't find any options to send ID to Facebook as other people have in past questions.
I've notified mutual friends and family and asked them to report the account (in the hope it will be disabled - it's already made spammy bitcoin posts) and then to delete "relative" from their friend list. I've removed the account from any group chats we were in together.
I've changed relative's email password and will be changing all other account passwords that they can think of. We'll make a new Facebook account linked to a different email address. (Yes, I would prefer they didn't use it at all but messenger is pretty important for them).
Is there anything else I should be doing?