The summary said she gave them her password. That sounds like permission.
The password was handed over under duress. Contracts signed under duress are legally invalid, so I would think that the implied permission given by the student under duress is also invalid.
The bigger problem here though is that the student actually thought that what she posted on facebook was somehow actually private.
There's no evidence that the student thought that what she posted was _private_. However, its reasonable to believe that only the people you've authorised to see to post are going to see the original post (doesn't stop one of those people copying and pasting it elsewhere though). I don't think it's reasonable to expect that someone is going to extract your password under duress to see a facebook post though (and the fact that they had to extract the password clearly shows that the post wasn't public...)
Once you release something on the internet you no longer have control of it - particularly when you give that something to a for-profit company.
Well that depends. When you sign up to a commercial service then you agree to a contract, which usually includes a privacy policy. And in the case of Facebook, they include privacy controls. It is reasonable to expect the commercial service to comply with the contract to protect your data - and indeed, if they don't then you can sue them for any damages it causes.
Assuming you've given one or more other people permission to see the post, then you can't make any guarantees about what _they_ will do with it - nothing stopping them making a copy of the post and redistributing it (although this may be covered under copyright law). However, that is no different to sending that post to those people in any other way - doing it on facebook makes no difference. If you sent a hand written message to a bunch of people via the postal service, you're in the same boat - nothing stopping one of those people redistributing the message.
However, all of that is irrelevant - the school didn't get to see the post because the student was careless and put it somewhere public, the school got to see it because they performed an illegal search of somewhere the school would not normally have access to. Doesn't matter whether they illegally searched the student's facebook account, bag, home, etc., the result is the same.