I read your post on getting mail from someone you once did business with, can only imagine how much this
SPAM fb mail annoyed you

I'm a regular facebook user so hope to help. You have your settings open so that "anyone" can message you, this is changed as follows:
Log in, go to "Account" on top right of the page then you will see:
Connecting on Facebook
Control basic information your friends will use to find you on Facebook
View settings The blue text is a link, click on the link & adjust accordingly then save & exit.
Also are you using a secure connection? Look at your URL address; if you see http: instead of https: then you don't have a secure session and you can be hacked.
Go to Account|Account Settings|Account Security and click Change.
Check the first setting, otherwise FB defaults to the non-secure setting.
NB: You are normally unable to use fb chat & most apps under a secure setting, the apps are where most of the virus problems stem from & I always advise people to leave them well alone however I know there are many who play games daily with no difficulty, caution advised at all times.
Hope that helps & makes sense!
Mark.