There are a few possibilities. It's very easy to make a fake facebook account, copy profile pic etc. So you would need to go back to Facebook and track IP's/email addresses etc to prove who setup the account that was used. There is also the possibility he accidentally left his Facebook account logged in to a Uni computer and someone else posted from his account - I don't know how this would be dealt this though?
